CVE-2021-3798
Medium
Description
A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.
SeverityMedium
CVSS5.5
Exploit probability—
ProductOpencryptoki
PublishedAug 23, 2022
First seenAug 23, 2022
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- opencryptoki_project opencryptoki3.17.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opencryptoki_project opencryptoki | v < 3.17.0 | 3.17.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.