CVE-2021-3505: fedoraproject fedora Insufficient Entropy
Vulnerability summary
CVE-2021-3505 is a medium (CVSS 5.5) Insufficient Entropy vulnerability in fedoraproject fedora. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 19-04-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.40% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundLibtpms
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- libtpms< 0.8.0~dev1-1
Fedoraproject1 product
- fedoraEOL33
Libtpms_project1 product
- libtpms< 0.8.0
Redhat1 product
4 vendors · 4 products
