DEBIAN-CVE-2026-21444
libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly used integration of libtpms with OpenSSL 3.x contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality. Version 0.10.2 fixes the issue. No known workarounds are available.
DEBIAN-CVE-2026-21444
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-21444
libtpms
Source reference: /affected/0/package/name
- Affected versions
- 0.10.1-1
Source reference:
/affected/0/versions0.10.1-2Source reference:
/affected/0/versions0.9.2-3.2Source reference:
/affected/0/versions0.9.2-3.2+hurd.1Source reference:
/affected/0/versions - Fixed versions
- 0.10.2-1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.2-1"
}
]
}
],
"package": {
"name": "libtpms",
"purl": "pkg:deb/debian/libtpms?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"0.10.1-1",
"0.10.1-2",
"0.9.2-3.2",
"0.9.2-3.2+hurd.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-21444.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57422 · Revision 1
- Added to Heist Feed
- Publisher date