Skip to content
OpenAdvisories
Medium ALSA-2023:7189 1 CVE

Moderate: fwupd security update

Published Nov 14, 2023 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The fwupd packages provide a service that allows session software to update device firmware.

Security Fix(es):

* fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 8 fwupd 1.7.8-2.el8
AlmaLinux · 8 fwupd-devel 1.7.8-2.el8

Vulnerabilities 1

  • Medium 6.5
    CVE-2022-3287

    When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/r…

    fwupd fwupd Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-3287
  • report
    https://bugzilla.redhat.com/2129904
  • advisory
    https://errata.almalinux.org/8/ALSA-2023-7189.html