Detections
Analytics

Fedora 45 : tpm2-tss (2026-14beb0815b)

high Nessus Plugin ID 374896

Language:

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-14beb0815b advisory.

 Security

 GHSA-h664-qxhh-gx3w CVE-2026-109545 GHSA-2q8j-chww-3pcq CVE-ID requested GHSA-5mqr-9575-x89w CVE-ID requested GHSA-rjg6-phr3-3rxw CVE-ID requested GHSA-g73j-fj87-wmqq CVE-ID requested GHSA-v965-wr7f-xw6w CVE-ID requested GHSA-5p93-qmch-h65j CVE-ID requested GHSA-x33j-3x4g-f32j CVE-ID requested GHSA-xvmm-58jj-c6gf CVE-ID requested

 Fixed

 MAINTAINERS: add Moritz TEST: use SHA-256 in EVP signing integration test TCTI: validate the response header length TCTI: add missing size checks for response buffers FAPI: fix quoting of empty event logs FAPI: check the number of branches for policy lists FAPI: validate key size before extracting the public key FAPI: add a missing bounds check on PCR_Select deserialization FAPI: check buffer size in RSASSA and RSAPSS signature conversion FAPI: reject eventlog entries with an empty template value FAPI: bound eventlog entry name reads by the template size FAPI: verify the eventlog digest window fits the template buffer FAPI: fix file leak on read error FAPI: fix tests failing with physical TPMs ESYS: fix compilation without SM4 support ESYS: fix OpenSSL 3.X engine context handling for internal crypto FAPI: fix buffer overflow in ifapi_set_auth_primary SYS: harden the response size checks SYS: validate the length of no-session responses SYS: validate the length of encrypted parameter responses SYS: validate the length of response authorization parameters SYS: use response size instead of buffer size during unmarshalling MU: bound subtype unmarshalling to the TPM2B size field IO: retry poll calls on EINTR and EAGAIN

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected tpm2-tss package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2026-14beb0815b

Plugin Details

Severity: High

ID: 374896

File Name: fedora_2026-14beb0815b.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/2/2026

Updated: 11/2/2026

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.55

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-109545

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:45, p-cpe:/a:fedoraproject:fedora:tpm2-tss

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/30/2026

Vulnerability Publication Date: 10/30/2026

Reference Information

CVE: CVE-2026-109545