Skip to content
OpenAdvisories
Low ELSA-2022-8100 1 CVE

Low: swtpm security and bug fix update (Oracle Linux 9)

Published Nov 22, 2022 · Updated Nov 22, 2022

Ecosystem: Oracle Linux

Summary

[0.7.0-3.20211109gitb79fd91]
- Disable OpenSSL FIPS mode to avoid libtpms failures
Resolves: rhbz#2090219

[0.7.0-2.20211109gitb79fd91]
- Add fix for CVE-2022-23645.
Resolves: rhbz#2056518

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 9 swtpm 0:0.7.0-3.20211109gitb79fd91.el9
Oracle Linux · 9 swtpm-libs 0:0.7.0-3.20211109gitb79fd91.el9
Oracle Linux · 9 swtpm-tools 0:0.7.0-3.20211109gitb79fd91.el9

Vulnerabilities 1

  • Medium 6.2
    CVE-2022-23645

    Out-of-bounds read in swtpm

    swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicato…

    stefanberger swtpm swtpm Debian