CVE-2021-3505

A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.

• CWE-331

• https://bugzilla.redhat.com/show_bug.cgi?id=1950046Issue Tracking, Patch, Third Party Advisory
• https://github.com/stefanberger/libtpms/issues/183Exploit, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NUCZX4S53TUNTSGTCRDNOQZV2V2RI4RJ/
• https://bugzilla.redhat.com/show_bug.cgi?id=1950046Issue Tracking, Patch, Third Party Advisory
• https://github.com/stefanberger/libtpms/issues/183Exploit, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NUCZX4S53TUNTSGTCRDNOQZV2V2RI4RJ/

Published

Apr 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35043OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes w…6.1
• CVE-2021-35045Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.O…6.1
• CVE-2021-35046A session fixation vulnerability was discovered in Ice Hrm 2…6.1
• CVE-2021-35047Vulnerability in the CommandPost, Collector, and Sensor comp…8.8
• CVE-2021-35048Vulnerability in Fidelis Network and Deception CommandPost e…9.8
• CVE-2021-35049Vulnerability in Fidelis Network and Deception CommandPost e…8.8
• CVE-2021-35050User credentials stored in a recoverable format within Fidel…7.5
• CVE-2021-35052A component in Kaspersky Password Manager could allow an att…7.8
• CVE-2021-35053Possible system denial of service in case of arbitrary chang…7.5
• CVE-2021-35054Minecraft before 1.17.1, when online-mode=false is configure…7.5
• CVE-2021-35055MediaTek microchips, as used in NETGEAR devices through 2021…8.8
• CVE-2021-35056Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0…6.7