The Tpm2 Tools Project maintains a specialized command-line utility suite for interacting with Trusted Platform Module 2.0 hardware, a niche but security-critical component in system attestation and key management. The observed disclosure history centers on this focused toolset with no established pattern of weakness classes emerging from the sparse vulnerability record. Current exploitation activity, severity distribution, and exposure metrics are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tpm2 Tools Project over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-7524HIGH tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC. | Jun 27, 2017 | 7.5 | 25 | NO | NO |
CVE-2024-29039HIGH tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SEL | Jun 28, 2024 | 8.1 | 24 | NO | NO |
CVE-2021-3565MEDIUM A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the | Jun 4, 2021 | 5.9 | 21 | NO | NO |
tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote | Jun 28, 2024 | 3.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tpm2 Tools Project.
Media articles that mention a CVE ID that affects a product developed by Tpm2 Tools Project — matched by CVE ID, not by vendor name.