Vulnerabilities > CVE-2021-3798 - Unspecified vulnerability in Opencryptoki Project Opencryptoki

CVSS 5.5 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

local

low complexity

opencryptoki-project

NVD

Published: 2022-08-23

Updated: 2024-11-21

Summary

A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.

Vulnerable Configurations

Part	Description	Count
Application	Opencryptoki_Project Opencryptoki Project Opencryptoki - Opencryptoki Project Opencryptoki 2.3.2 Opencryptoki Project Opencryptoki 2.3.3 Opencryptoki Project Opencryptoki 2.4.2 Opencryptoki Project Opencryptoki 2.4.3 Opencryptoki Project Opencryptoki 2.4.3.1 Opencryptoki Project Opencryptoki 3.0 Opencryptoki Project Opencryptoki 3.1 Opencryptoki Project Opencryptoki 3.2 Opencryptoki Project Opencryptoki 3.3 Opencryptoki Project Opencryptoki 3.4 Opencryptoki Project Opencryptoki 3.4.1 Opencryptoki Project Opencryptoki 3.5 Opencryptoki Project Opencryptoki 3.6 Opencryptoki Project Opencryptoki 3.6.1 Opencryptoki Project Opencryptoki 3.6.2 Opencryptoki Project Opencryptoki 3.7.0 Opencryptoki Project Opencryptoki 3.8.0 Opencryptoki Project Opencryptoki 3.8.1 Opencryptoki Project Opencryptoki 3.8.2 Opencryptoki Project Opencryptoki 3.9.0 Opencryptoki Project Opencryptoki 3.10.0 Opencryptoki Project Opencryptoki 3.11.0 Opencryptoki Project Opencryptoki 3.11.1 Opencryptoki Project Opencryptoki 3.12.0 Opencryptoki Project Opencryptoki 3.12.1 Opencryptoki Project Opencryptoki 3.13.0 Opencryptoki Project Opencryptoki 3.14.0 Opencryptoki Project Opencryptoki 3.15.0 Opencryptoki Project Opencryptoki 3.15.1 Opencryptoki Project Opencryptoki 3.16.0	31

Summary

Vulnerable Configurations

References