Skip to content
OpenAdvisories
Medium RHSA-2025:12100 1 CVE

Red Hat Security Advisory: libtpms security update

Published Jul 30, 2025 · Updated Aug 7, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream libtpms 0:0.9.1-5.20211126git1ff6fe1f43.el9_6
Red Hat · RHEL 9 enterprise_linux:9::appstream libtpms-debuginfo 0:0.9.1-5.20211126git1ff6fe1f43.el9_6
Red Hat · RHEL 9 enterprise_linux:9::appstream libtpms-debugsource 0:0.9.1-5.20211126git1ff6fe1f43.el9_6

Vulnerabilities 1

  • Medium 5.9
    CVE-2025-49133

    Libtpms contains a possible out-of-bound access and abort due to HMAC signing issue

    Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bou…

    stefanberger libtpms libtpms libtpms Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2371585
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12100.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-49133
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-49133
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-49133
  • article
    https://github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a23e58c0de11532d1
  • article
    https://github.com/stefanberger/libtpms/security/advisories/GHSA-25w5-6fjj-hf8g
  • article
    https://trustedcomputinggroup.org/resource/tpm-library-specification
  • article
    https://trustedcomputinggroup.org/wp-content/uploads/TPM-2.0-1.83-Part-4-Supporting-Routines-Code.pdf