Skip to content
OpenAdvisories
Medium RHSA-2025:16428 1 CVE

Red Hat Security Advisory: libtpms security update

Published Sep 23, 2025 · Updated Aug 7, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.0 libtpms 0:0.9.6-11.el10_0
Red Hat · RHEL 10 enterprise_linux:10.0 libtpms-debuginfo 0:0.9.6-11.el10_0
Red Hat · RHEL 10 enterprise_linux:10.0 libtpms-debugsource 0:0.9.6-11.el10_0

Vulnerabilities 1

  • Medium 5.9
    CVE-2025-49133

    Libtpms contains a possible out-of-bound access and abort due to HMAC signing issue

    Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bou…

    stefanberger libtpms libtpms libtpms Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2371585
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16428.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-49133
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-49133
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-49133
  • article
    https://github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a23e58c0de11532d1
  • article
    https://github.com/stefanberger/libtpms/security/advisories/GHSA-25w5-6fjj-hf8g
  • article
    https://trustedcomputinggroup.org/resource/tpm-library-specification
  • article
    https://trustedcomputinggroup.org/wp-content/uploads/TPM-2.0-1.83-Part-4-Supporting-Routines-Code.pdf