CVE-2020-10759
Summary
| CVE | CVE-2020-10759 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-09-15 19:15:00 UTC |
|---|
| Updated | 2023-02-12 23:39:00 UTC |
|---|
| Description | A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. The highest threat from this vulnerability is to confidentiality and integrity. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Red Hat Customer Portal - Access to 24x7 support and knowledge |
MISC |
access.redhat.com |
|
| Red Hat Customer Portal - Access to 24x7 support and knowledge |
MISC |
access.redhat.com |
|
| 1844316 – (CVE-2020-10759) CVE-2020-10759 fwupd: Possible bypass in signature verification |
MISC |
bugzilla.redhat.com |
Issue Tracking, Third Party Advisory |
| advisories/2020_fwupd_dangling_s3_bucket_and_CVE-2020-10759_signature_verification_bypass.md at master · justinsteven/advisories · GitHub |
MISC |
github.com |
Exploit, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 174879 SUSE Enterprise Linux Security Update for fwupd (SUSE-SU-2021:1107-1)
- 177933 Debian Security Update for fwupd (DLA 2274-1)
- 377414 Alibaba Cloud Linux Security Update for fwupd (ALINUX3-SA-2021:0048)
- 750279 OpenSUSE Security Update for fwupd (openSUSE-SU-2021:0522-1)
- 940203 AlmaLinux Security Update for gnome-software and fwupd (ALSA-2020:4436)
- 960378 Rocky Linux Security Update for gnome-software and fwupd (RLSA-2020:4436)
