During tpm2_import command invocation a fixed AES wrapping key is used. This presents a weakness in that, when no encrypted session with the TPM is used, the encrypted inner wrapper key is known and thus an entity performing an MITM on the TPM would be able to unwrap the inner portion and reveal the key being imported.
Created tpm2-tools tracking bugs for this issue:
Affects: epel-7 [bug 1964429]
Affects: fedora-all [bug 1964428]
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2021:4413 https://access.redhat.com/errata/RHSA-2021:4413
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):