SB2026012742 - IBM PowerVM Hypervisor update for Mbed TLS
Published: January 27, 2026
Security Bulletin ID
SB2026012742
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Covert Timing Channel (CVE-ID: CVE-2025-49087)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to a timing side channel attack on its implementation of PKCS#7 padding removal. A remote attacker with access to timing information and a decryption oracle can recover the last byte of each plaintext block. If some portion of the plaintext is controlled by the attacker as is often the case, the whole plaintext can be recovered.
Remediation
Install update from vendor's website.