CVE-2021-3798 describes a flaw in openCryptoki's Soft token where it fails to validate EC keys during creation or key derivation, specifically when using C_CreateObject or C_DeriveKey with ECDH public data. This vulnerability, rated Medium (CVSS 5.5), could allow a local, low-privileged attacker to extract private keys through an invalid curve attack, leading to a high confidentiality impact. There is no evidence of active exploitation, public exploit code, or significant community discussion, indicating a low current threat landscape.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.17.0CPE matchmatch criteria | cpe:2.3:a:opencryptoki_project:opencryptoki:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.
Aug 9, 2022openCryptoki: Soft token does not check if an EC key is valid
May 18, 2021