Skip to content
OpenAdvisories
Medium ELSA-2024-8935 1 CVE

Moderate: edk2 security update (Oracle Linux 9)

Published Nov 6, 2024 · Updated Nov 6, 2024

Ecosystem: Oracle Linux

Summary

[20231122-6.0.1.el9_4.4]
- Replace upstream references [Orabug:36569119]

[20231122-6.el9_4.4]
- edk2-Bumped-openssl-submodule-version-to-0205b5898872.patch [RHEL-55337]
- Resolves: RHEL-55337
(CVE-2024-6119 edk2/openssl: Possible denial of service in X.509 name checks [rhel-9.4.z])

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 9 edk2-aarch64 0:20231122-6.0.1.el9_4.4
Oracle Linux · 9 edk2-ovmf 0:20231122-6.0.1.el9_4.4
Oracle Linux · 9 edk2-tools 0:20231122-6.0.1.el9_4.4
Oracle Linux · 9 edk2-tools-doc 0:20231122-6.0.1.el9_4.4

Vulnerabilities 1

  • High 7.5
    CVE-2024-6119 EPSS 67%

    Possible denial of service in X.509 name checks

    Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi