CVE-2021-43392 - Vulnerability Details - OpenCVE

ReportizFlow

STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:L/AC:M/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
St	J-safe3 J-safe3 Firmware Stsafe-j Stsafe-j Firmware

Configuration 1 [-]

AND

cpe:2.3:o:st:j-safe3_firmware:1.2.5:*:*:*:*:*:*:*

cpe:2.3:h:st:j-safe3:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:st:stsafe-j_firmware:1.1.4:*:*:*:*:*:*:*

cpe:2.3:h:st:stsafe-j:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://community.st.com/s/toparticles
https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-03-04T12:54:53

Updated: 2024-08-04T03:55:28.821Z

Reserved: 2021-11-04T00:00:00

Link: CVE-2021-43392

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-03-04T13:15:08.193

Modified: 2024-11-21T06:29:08.873

Link: CVE-2021-43392

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-03-04T12:54:53", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://community.st.com/s/toparticles"}, {"tags": ["x_refsource_MISC"], "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2021-43392", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://community.st.com/s/toparticles", "refsource": "MISC", "url": "https://community.st.com/s/toparticles"}, {"name": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/", "refsource": "MISC", "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:55:28.821Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://community.st.com/s/toparticles"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-43392", "datePublished": "2022-03-04T12:54:53", "dateReserved": "2021-11-04T00:00:00", "dateUpdated": "2024-08-04T03:55:28.821Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:st:j-safe3_firmware:1.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "BC735EDA-3D15-4623-A29E-0D717D35E9BF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:st:j-safe3:-:*:*:*:*:*:*:*", "matchCriteriaId": "7C03B714-DC65-404C-8052-86E9CE1BE561", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:st:stsafe-j_firmware:1.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "BC8F50AF-97F7-47B1-BDE2-AC15446F1768", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:st:stsafe-j:-:*:*:*:*:*:*:*", "matchCriteriaId": "80AB60B5-F0C0-46A8-B05A-0C11F35EE49E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform."}, {"lang": "es", "value": "STMicroelectronics STSAFE-J versiones 1.1.4, J-SAFE3 1.2.5 y J-SIGN a veces permiten a atacantes obtener informaci\u00f3n sobre secretos criptogr\u00e1ficos. Esto est\u00e1 asociado con el algoritmo de firma ECDSA en las plataformas Java Card J-SAFE3 y STSAFE-J que exponen una API de Java Card 3.0.4. Es explotable para STSAFE-J en configuraci\u00f3n cerrada y J-SIGN (cuando la verificaci\u00f3n de firma est\u00e1 habilitada) pero no para los productos J-SAFE3 EPASS BAC y EAC. Tambi\u00e9n podr\u00eda afectar a otros productos basados en la plataforma J-SAFE-3 Java Card"}], "id": "CVE-2021-43392", "lastModified": "2024-11-21T06:29:08.873", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-03-04T13:15:08.193", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://community.st.com/s/toparticles"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://community.st.com/s/toparticles"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "[email protected]", "type": "Primary"}]}