Summary
The gnome-software packages contain an application that makes it easy to add, remove, and update software in the GNOME desktop.
The appstream-data package provides the distribution specific AppStream metadata required for the GNOME and KDE software centers.
The fwupd packages provide a service that allows session software to update device firmware.
The following packages have been upgraded to a later upstream version: gnome-software (3.36.1), fwupd (1.4.2).
Security Fix(es):
* fwupd: Possible bypass in signature verification (CVE-2020-10759)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | appstream-data | 8-20200724.el8 |
| AlmaLinux · 8 | libxmlb | 0.1.15-1.el8 |
Vulnerabilities 1
-
Unscored —CVE-2020-10759 Public exploit
A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmwar…
References
-
report
https://access.redhat.com/security/cve/CVE-2020-10759
-
report
https://bugzilla.redhat.com/1797932
-
report
https://bugzilla.redhat.com/1815502
-
report
https://bugzilla.redhat.com/1839774
-
report
https://bugzilla.redhat.com/1844316
-
report
https://bugzilla.redhat.com/1844488
-
report
https://bugzilla.redhat.com/1845714
-
advisory
https://errata.almalinux.org/8/ALSA-2020-4436.html
-
report
https://vulners.com/cve/CVE-2020-10759