CVE-2021-43393

STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.

• CWE-347

• https://community.st.com/s/toparticlesVendor Advisory
• https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/Third Party Advisory
• https://community.st.com/s/toparticlesVendor Advisory
• https://www.cert.ssi.gouv.fr/avis/CERTFR-2022-AVI-169/Third Party Advisory

Published

Mar 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43388Unisys Cargo Mobile Application before 1.2.29 uses cleartext…7.5
• CVE-2021-43389An issue was discovered in the Linux kernel before 5.14.15. …5.5
• CVE-2021-4339The uListing plugin for WordPress is vulnerable to authoriza…5.3
• CVE-2021-43390An Out-of-Bounds Write vulnerability exists when reading a D…7.8
• CVE-2021-43391An Out-of-Bounds Read vulnerability exists when reading a DX…7.8
• CVE-2021-43392STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN…6.2
• CVE-2021-43394Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC…9.8
• CVE-2021-43395An issue was discovered in illumos before f859e7171bb5db3432…5.5
• CVE-2021-43396In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc…7.5
• CVE-2021-43397LiquidFiles before 3.6.3 allows remote attackers to elevate …8.8
• CVE-2021-43398Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing …5.3
• CVE-2021-43399The Yubico YubiHSM YubiHSM2 library 2021.08, included in the…7.5