CVE-2021-43393 - Vulnerability Details - OpenCVE

ReportizFlow

STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:L/AC:M/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
St	J-safe3 J-safe3 Firmware Stsafe-j Stsafe-j Firmware

Configuration 1 [-]

AND

cpe:2.3:o:st:stsafe-j_firmware:1.1.4:*:*:*:*:*:*:*

cpe:2.3:h:st:stsafe-j:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:st:j-safe3_firmware:1.2.5:*:*:*:*:*:*:*

cpe:2.3:h:st:j-safe3:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://community.st.com/s/toparticles
https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-03-04T12:54:50

Updated: 2024-08-04T03:55:28.645Z

Reserved: 2021-11-04T00:00:00

Link: CVE-2021-43393

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-03-04T13:15:08.240

Modified: 2024-11-21T06:29:09.033

Link: CVE-2021-43393

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-03-04T12:54:50", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://community.st.com/s/toparticles"}, {"tags": ["x_refsource_MISC"], "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2021-43393", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://community.st.com/s/toparticles", "refsource": "MISC", "url": "https://community.st.com/s/toparticles"}, {"name": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/", "refsource": "MISC", "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:55:28.645Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://community.st.com/s/toparticles"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-43393", "datePublished": "2022-03-04T12:54:50", "dateReserved": "2021-11-04T00:00:00", "dateUpdated": "2024-08-04T03:55:28.645Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:st:stsafe-j_firmware:1.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "BC8F50AF-97F7-47B1-BDE2-AC15446F1768", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:st:stsafe-j:-:*:*:*:*:*:*:*", "matchCriteriaId": "80AB60B5-F0C0-46A8-B05A-0C11F35EE49E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:st:j-safe3_firmware:1.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "BC735EDA-3D15-4623-A29E-0D717D35E9BF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:st:j-safe3:-:*:*:*:*:*:*:*", "matchCriteriaId": "7C03B714-DC65-404C-8052-86E9CE1BE561", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform."}, {"lang": "es", "value": "STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, y J-SIGN a veces permiten a atacantes abusar de la verificaci\u00f3n de firmas. Esto est\u00e1 asociado con el algoritmo de firma ECDSA en las plataformas Java Card J-SAFE3 y STSAFE-J que exponen una API Java Card versi\u00f3n 3.0.4. Es explotable para STSAFE-J en configuraci\u00f3n cerrada y J-SIGN (cuando la verificaci\u00f3n de firmas est\u00e1 activada) pero no para los productos J-SAFE3 EPASS BAC y EAC. Tambi\u00e9n podr\u00eda afectar a otros productos basados en la plataforma J-SAFE-3 Java Card"}], "id": "CVE-2021-43393", "lastModified": "2024-11-21T06:29:09.033", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-03-04T13:15:08.240", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://community.st.com/s/toparticles"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://community.st.com/s/toparticles"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "[email protected]", "type": "Primary"}]}