Skip to content
OpenAdvisories
Medium ALSA-2023:2487 4 CVEs

Moderate: fwupd security and bug fix update

Published May 9, 2023 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The fwupd packages provide a service that allows session software to update device firmware.

Security Fix(es):

* fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287)
* shim: 3rd party shim allow secure boot bypass (CVE-2022-34301)
* shim: 3rd party shim allow secure boot bypass (CVE-2022-34302)
* shim: 3rd party shim allow secure boot bypass (CVE-2022-34303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 3

ReleasePackageFixed in
AlmaLinux · 9 fwupd 1.8.10-2.el9.alma
AlmaLinux · 9 fwupd-devel 1.8.10-2.el9.alma
AlmaLinux · 9 fwupd-plugin-flashrom 1.8.10-2.el9.alma

Vulnerabilities 4

  • Medium 6.5
    CVE-2022-3287

    When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/r…

    fwupd fwupd Debian Ubuntu
  • Unscored —
    CVE-2022-34301 Public exploit

    A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass …

  • Unscored —
    CVE-2022-34302 Public exploit

    A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or…

  • Unscored —
    CVE-2022-34303 Public exploit

    A flaw was found in Eurosoft bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper wit…

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-3287
  • report
    https://access.redhat.com/security/cve/CVE-2022-34301
  • report
    https://access.redhat.com/security/cve/CVE-2022-34302
  • report
    https://access.redhat.com/security/cve/CVE-2022-34303
  • report
    https://bugzilla.redhat.com/2120687
  • report
    https://bugzilla.redhat.com/2120699
  • report
    https://bugzilla.redhat.com/2120701
  • report
    https://bugzilla.redhat.com/2129904
  • advisory
    https://errata.almalinux.org/9/ALSA-2023-2487.html