Mageia 2020-0417: tpm2-tss security update
Summary
FAPI PolicyPCR not instatiating correctly (CVE-2020-24455).
Note that all TPM object created with a PolicyPCR with the currentPcrsand currentPcrsAndBank options have been created with an incorrect policy
that omits PCR checks. All such objects have to be recreated.
The tpm2-tss package has been updated to version 2.4.3, which includes a fix
for this issue and several other changes. See the upstream release
announcements for details.
References
- https://bugs.mageia.org/show_bug.cgi?id=27412
- https://github.com/tpm2-software/tpm2-tss/releases/tag/2.4.3
- https://github.com/tpm2-software/tpm2-tss/releases
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KBRTMYDRPQBDGNADVXGI745WGT2MGVOO/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24455
Resolution
MGASA-2020-0417 - Updated tpm2-tss packages fix a security vulnerability
SRPMS
- 7/core/tpm2-tss-2.4.3-1.mga7