PatchTheCVElibtomcrypt vulnerabilities and fixes
Recent CVEs affecting libtomcrypt, with upgrade or downgrade steps. 4 tracked.
libtomcrypt has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2019-10-09. Highest priority: CVE-2019-17362 (score 69/100).
- CVE-2019-17362 CRITICAL 9.1 UPGRADE MITIGATE In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not prop
- CVE-2018-12437 MEDIUM 4.9 UPGRADE UPGRADE LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of th
- CVE-2016-6129 HIGH 7.5 UPGRADE UPGRADE The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not
- CVE-2005-1600 HIGH 7.5 DOWNGRADE A "mathematical flaw" in the implementation of the El Gamal signature algorithm for LibTomCrypt 1.0 to 1.0.2 a
FAQ
How do I fix libtomcrypt vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libtomcrypt being exploited right now?
None of the tracked libtomcrypt CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libtomcrypt CVE should I patch first?
CVE-2019-17362 currently ranks highest (69/100): In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not prop.