< back to search

shield Security update for tpm2.0-tools, tpm2-0-tss
SUSE-SLE-Micro-6.0-250

This update for tpm2.0-tools, tpm2-0-tss fixes the following issues: tpm2-0-tss: Update to version 4.1: + Security - CVE-2024-29040: arbitrary quote data may go undetected by Fapi_VerifyQuote (bsc#1223690) + Fixed - fapi: Fix length check on FAPI auth callbacks - mu: Correct error message for errors - tss2-rc: fix unknown laer handler dropping bits. - fapi: Fix deviation from CEL specification (template_value was used instead of template_data). - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c. - build: fix build fail after make clean. - mu: Fix unneeded size check in TPM2B unmarshaling. - fapi: Fix missing parameter encryption. - build: Fix failed build with --disable-vendor. - fapi: Fix flush of persistent handles. - fapi: Fix test provisioning with template with self generated certificate disabled. - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs. - fapi: Revert pcr extension for EV_NO_ACTION events. - fapi: Fix strange error messages if nv, ext, or policy path does not exits. - fapi: Fix segfault caused by wrong allocation of pcr policy. - esys: Fix leak in Esys_EvictControl for persistent handles. - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform. - esys: Add reference counting for Esys_TR_FromTPMPublic. - esys: Fix HMAC error if session bind key has an auth value with a trailing 0. - fapi: fix usage of self signed certificates in TPM. - fapi: Usage of self signed certificates. - fapi: A segfault after the error handling of non existing keys. - fapi: Fix several leaks. - fapi: Fix error handling for policy execution. - fapi: Fix usage of persistent handles (should not be flushed) - fapi: Fix test provisioning with template (skip test without self generated certificate). - fapi: Fix pcr extension for EV_NO_ACTION - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set - fapi: Fix read large system eventlog (> UINT16_MAX). - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0) - test: unit: tcti-libtpms: fix test failed at 32-bit platforms. - fapi: Fix possible null pointer dereferencing in Fapi_List. - sys: Fix size check in Tss2_Sys_GetCapability. - esys: Fix leak in Esys_TR_FromTPMPublic. - esys: fix unchecked return value in esys crypto. - fapi: Fix wrong usage of local variable in provisioning. - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize. - fapi: Fix possible out of bound array access in IMA parser. - tcti device: Fix possible unmarshalling from uninitialized variable. - fapi: Fix error checking authorization of signing key. - fapi: Fix cleanup of policy sessions. - fapi: Eventlog H-CRTM events and different localities. - fapi: Fix missing synchronization of quote and eventlog. - faii: Fix invalid free in Fapi_Quote with empty eventlog. + Added - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go. - mbedtls: add sha512 hmac. - fapi: Enable usage of external keys for Fapi_Encrypt. - fapi: Support download of AMD certificates. - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module. - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed. - rc: New TPM return codes added. - fapi: Further Nuvoton certificates added. - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec. - tcti: Add '/dev/tcm0' to default conf - fapi: New Nuvoton certificates added. - esys: Fix leak in Esys_TR_FromTPMPublic. + Removed - Testing on Ubuntu 18.04 as it's near EOL (May 2023). tpm2.0-tools: Update to version 5.7: + Security - CVE-2024-29038: arbitrary quote data may go undetected by tpm2_checkquote (bsc#1223687) - CVE-2024-29039: pcr selection value is not compared with the attest (bsc#1223689) + Fixed - Fix eventlog test - Fix issues with reading NV indexes - Fix context save error on tpm2_create - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail - when attempting to context save a flushed session. - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto. - tpm2_send: fix EOF detection on input stream. - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems. - tpm2_nvread: fix input handling no nv index. - Auth file: Ensure 0-termination when reading auths from a file. - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh. - cirrus.yml fix tss compilation with libtpms for FreeBSD. - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd. - options: fix TCTI handling to avoid failures for commands that should work with no options. - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed. + Added - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option) + Removed - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems. - tpm2_nvread: fix input handling no nv index. - Update to version 5.6 + tpm2_eventlog: * add H-CRTM event support * add support of efivar versions less than 38 * Add support to check for efivar/efivar.h manually * Minor formatting fixes * tpm2_eventlog: add support for replay with different StartupLocality * Fix pcr extension for EV_NO_ACTION * Extend test of yaml string representation * Use helper for printing a string dump * Fix upper bound on unique data size * Fix YAML string formatting + tpm2_policy: * Add support for parsing forward seal TPM values * Use forward seal values in creating policies * Move dgst_size in evaluate_populate_pcr_digests() * Allow more than 8 PCRs for sealing * Move dgst_size in evaluate_populate_pcr_digests * Allow more than 8 PCRs for sealing * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more PCRs + tpm2_encryptdecrypt: Fix pkcs7 padding stripping + tpm2_duplicate: * Support -a option for attributes * Add --key-algorithm option + tpm2_encodeobject: Use the correct -O option instead of -C + tpm2_unseal: Add qualifier static to enhance the privacy of unseal function + tpm2_sign: * Remove -m option which was added mistakenly * Revert sm2 sign and verifysignature + tpm2_createek: * Correct man page example * Fix usage of nonce * Fix integrating nonce + tpm2_clear: add more details about the action + tpm2_startauthsession: allow the file attribute for policy authorization. + tpm2_getekcertificate: Add AMD EK support + tpm2_ecdhzgen: Add public-key parameter + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure + Bug-fixes: * The readthedocs build failed with module 'jinja2' has no attribute 'contextfilter' a requirement file was added to fix this problem * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa implementation. This error can be avoided by switching off the optimization with pragma * Changed wrong function name of "Esys_Load" to "Esys_Load" * Function names beginning with Esys_ are wrongly written as Eys_ * Reading and writing a serialized persistent ESYS_TR handles * cirrus-ci update image-family to freebsd-13-2 from 13-1 + misc: * Change the default Python version to Python3 in the helper's code * Skip test which uses the sign operator for comparison in abrmd_policynv.sh * tools/tr_encode: Add a tool that can encode serialized ESYS_TR for persistent handles from the TPM2B_PUBLIC and the raw persistent TPM2_HANDLE * Add safe directory in config

cloud_download Downloads

SUSE Linux Micro 6.0 aarch64
  • Packages
    libefivar1
    Library to manage UEFI variables
    38-3.1 lock rpm
    libtss2-esys0
    TPM2 Enhanced System API (ESAPI)
    4.1.0-1.1 lock rpm
    libtss2-fapi-common
    Common files for FAPI interface library
    4.1.0-1.1 lock rpm
    libtss2-fapi1
    FAPI interface library
    4.1.0-1.1 lock rpm
    libtss2-mu0
    TPM2 marshaling/unmarshaling library
    4.1.0-1.1 lock rpm
    libtss2-rc0
    TPM2 error code translation library
    4.1.0-1.1 lock rpm
    libtss2-sys1
    TPM2 System API (SAPI)
    4.1.0-1.1 lock rpm
    libtss2-tcti-device0
    TCTI interface library for using a native TPM device node
    4.1.0-1.1 lock rpm
    libtss2-tcti-spi-helper0
    TCTI spi interface library
    4.1.0-1.1 lock rpm
    libtss2-tcti-spidev0
    TCTI interface library for communicating with a SPI attached TPM
    4.1.0-1.1 lock rpm
    libtss2-tctildr0
    TCTI interface loading library
    4.1.0-1.1 lock rpm
    tpm2-0-tss
    Intel's TCG Software Stack access libraries for TPM 2.0 chips
    4.1.0-1.1 lock rpm
    tpm2.0-tools
    Trusted Platform Module (TPM) 2.0 administration tools
    5.7-1.1 lock rpm
SUSE Linux Micro 6.0 s390x
  • Packages
    libefivar1
    Library to manage UEFI variables
    38-3.1 lock rpm
    libtss2-esys0
    TPM2 Enhanced System API (ESAPI)
    4.1.0-1.1 lock rpm
    libtss2-fapi-common
    Common files for FAPI interface library
    4.1.0-1.1 lock rpm
    libtss2-fapi1
    FAPI interface library
    4.1.0-1.1 lock rpm
    libtss2-mu0
    TPM2 marshaling/unmarshaling library
    4.1.0-1.1 lock rpm
    libtss2-rc0
    TPM2 error code translation library
    4.1.0-1.1 lock rpm
    libtss2-sys1
    TPM2 System API (SAPI)
    4.1.0-1.1 lock rpm
    libtss2-tcti-device0
    TCTI interface library for using a native TPM device node
    4.1.0-1.1 lock rpm
    libtss2-tcti-spi-helper0
    TCTI spi interface library
    4.1.0-1.1 lock rpm
    libtss2-tcti-spidev0
    TCTI interface library for communicating with a SPI attached TPM
    4.1.0-1.1 lock rpm
    libtss2-tctildr0
    TCTI interface loading library
    4.1.0-1.1 lock rpm
    tpm2-0-tss
    Intel's TCG Software Stack access libraries for TPM 2.0 chips
    4.1.0-1.1 lock rpm
    tpm2.0-tools
    Trusted Platform Module (TPM) 2.0 administration tools
    5.7-1.1 lock rpm
SUSE Linux Micro 6.0 x86_64
  • Packages
    libefivar1
    Library to manage UEFI variables
    38-3.1 lock rpm
    libtss2-esys0
    TPM2 Enhanced System API (ESAPI)
    4.1.0-1.1 lock rpm
    libtss2-fapi-common
    Common files for FAPI interface library
    4.1.0-1.1 lock rpm
    libtss2-fapi1
    FAPI interface library
    4.1.0-1.1 lock rpm
    libtss2-mu0
    TPM2 marshaling/unmarshaling library
    4.1.0-1.1 lock rpm
    libtss2-rc0
    TPM2 error code translation library
    4.1.0-1.1 lock rpm
    libtss2-sys1
    TPM2 System API (SAPI)
    4.1.0-1.1 lock rpm
    libtss2-tcti-device0
    TCTI interface library for using a native TPM device node
    4.1.0-1.1 lock rpm
    libtss2-tcti-spi-helper0
    TCTI spi interface library
    4.1.0-1.1 lock rpm
    libtss2-tcti-spidev0
    TCTI interface library for communicating with a SPI attached TPM
    4.1.0-1.1 lock rpm
    libtss2-tctildr0
    TCTI interface loading library
    4.1.0-1.1 lock rpm
    tpm2-0-tss
    Intel's TCG Software Stack access libraries for TPM 2.0 chips
    4.1.0-1.1 lock rpm
    tpm2.0-tools
    Trusted Platform Module (TPM) 2.0 administration tools
    5.7-1.1 lock rpm