Ubuntu CVE Tracker

Merge ~federicoquattrin/ubuntu-cve-tracker:update_tpm2_tss_CVEs into ubuntu-cve-tracker:master

  1. Git
  2. lp:~federicoquattrin/ubuntu-cve-tracker
  3. update_tpm2_tss_CVEs
  4. Merge into master
Proposed by Federico Quattrin
Status: Merged
Merged at revision: 030bd198261d8bb8f1dc9b9778bfb798a310ea89
Proposed branch: ~federicoquattrin/ubuntu-cve-tracker:update_tpm2_tss_CVEs
Merge into: ubuntu-cve-tracker:master
Diff against target: 78 lines (+16/-12)
2 files modified
active/CVE-2023-22745 (+7/-5)
active/CVE-2024-29040 (+9/-7)
Reviewer Review Type Date Requested Status
Rodrigo Figueiredo Zaiden Approve
Review via email: mp+466624@code.launchpad.net

Commit message

updated tpm2-tss CVEs with USN-6796-1 information

Description of the change

updated tpm2-tss CVEs with USN-6796-1 information

To post a comment you must log in.
Revision history for this message
Rodrigo Figueiredo Zaiden (rodrigo-zaiden) wrote :

LGTM. Thanks, merging.

review: Approve

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
1diff --git a/active/CVE-2023-22745 b/active/CVE-2023-22745
2index 23f9166..5f894b7 100644
3--- a/active/CVE-2023-22745
4+++ b/active/CVE-2023-22745
5@@ -1,8 +1,10 @@
6+PublicDateAtUSN: 2023-01-19 23:15:00 UTC
7 Candidate: CVE-2023-22745
8 PublicDate: 2023-01-19 23:15:00 UTC
9 References:
10 https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-4j3v-fh23-vx67
11 https://www.cve.org/CVERecord?id=CVE-2023-22745
12+ https://ubuntu.com/security/notices/USN-6796-1
13 Description:
14 tpm2-tss is an open source software implementation of the Trusted Computing
15 Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In
16@@ -24,7 +26,7 @@ Mitigation:
17 Bugs:
18 Priority: low
19 Discovered-by:
20-Assigned-to: federicoquattrin
21+Assigned-to:
22 CVSS:
23 nvd: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H [6.4 MEDIUM]
24
25@@ -33,11 +35,11 @@ Patches_tpm2-tss:
26 upstream_tpm2-tss: released (3.2.1-3)
27 trusty_tpm2-tss: ignored (end of standard support)
28 xenial_tpm2-tss: ignored (end of standard support)
29-esm-apps/xenial_tpm2-tss: needs-triage
30+esm-apps/xenial_tpm2-tss: not-affected (code not present)
31 bionic_tpm2-tss: ignored (end of standard support, was needed)
32-esm-apps/bionic_tpm2-tss: needs-triage
33-focal_tpm2-tss: needed
34-jammy_tpm2-tss: needed
35+esm-apps/bionic_tpm2-tss: not-affected (code not present)
36+focal_tpm2-tss: released (2.3.2-1ubuntu0.20.04.2)
37+jammy_tpm2-tss: released (3.2.0-1ubuntu1.1)
38 kinetic_tpm2-tss: ignored (end of life, was needed)
39 lunar_tpm2-tss: not-affected (3.2.1-3ubuntu1)
40 mantic_tpm2-tss: not-affected (3.2.1-3ubuntu1)
41diff --git a/active/CVE-2024-29040 b/active/CVE-2024-29040
42index 242223a..0598d93 100644
43--- a/active/CVE-2024-29040
44+++ b/active/CVE-2024-29040
45@@ -1,8 +1,10 @@
46+PublicDateAtUSN: 2024-04-30
47 Candidate: CVE-2024-29040
48 PublicDate: 2024-04-30
49 References:
50 https://www.cve.org/CVERecord?id=CVE-2024-29040
51- https://github.com/tpm2-software/tpm2-tss/commit/710cd0b6adf3a063f34a8e92da46df7a107d9a99 (4.1.0)
52+ https://github.com/tpm2-software/tpm2-tss/commit/710cd0b6adf3a063f34a8e92da46df7a107d9a99
53+ https://ubuntu.com/security/notices/USN-6796-1
54 Description:
55 After deserializing the quote info it was not checked whether
56 the magic number in the attest is equal TPM2_GENERATED_VALUE.
57@@ -14,15 +16,15 @@ Mitigation:
58 Bugs:
59 Priority: medium
60 Discovered-by:
61-Assigned-to: federicoquattrin
62+Assigned-to:
63 CVSS:
64
65 Patches_tpm2-tss:
66-upstream_tpm2-tss: needs-triage
67+upstream_tpm2-tss: released (4.1.0)
68 esm-apps/xenial_tpm2-tss: not-affected (code not present)
69 esm-apps/bionic_tpm2-tss: not-affected (code not present)
70 focal_tpm2-tss: not-affected (code not present)
71-jammy_tpm2-tss: needed
72-mantic_tpm2-tss: needed
73-noble_tpm2-tss: needs-triage
74-devel_tpm2-tss: needs-triage
75+jammy_tpm2-tss: released (3.2.0-1ubuntu1.1)
76+mantic_tpm2-tss: released (4.0.1-3ubuntu1.1)
77+noble_tpm2-tss: released (4.0.1-7.1ubuntu5.1)
78+devel_tpm2-tss: needed

Subscribers

People subscribed via source and target branches