Summary
[20251114-5.0.1.el10_2.2]
- Replace upstream references [Orabug:36569119]
[20251114-5.el10_2.2]
- edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421]
- edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699]
- Resolves: RHEL-182421
(edk2/x64: re-enable legacy kernel loader [rhel-10.2.z])
- Resolves: RHEL-165699
(CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2])
[20251114-5.el10_2.1]
- edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573]
- Resolves: RHEL-161573
(CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2])
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | edk2-aarch64 | 0:20251114-5.0.1.el10_2.2 |
| Oracle Linux · 10 | edk2-ovmf | 0:20251114-5.0.1.el10_2.2 |
| Oracle Linux · 10 | edk2-tools | 0:20251114-5.0.1.el10_2.2 |
| Oracle Linux · 10 | edk2-tools-doc | 0:20251114-5.0.1.el10_2.2 |
Vulnerabilities 1
-
Critical 9.8
Out-of-bounds read & write in RFC 3211 KEK Unwrap
Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application…