Summary
[20251114-5.0.1.el10_2.2]
- Replace upstream references [Orabug:36569119]
[20251114-5.el10_2.2]
- edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421]
- edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699]
- Resolves: RHEL-182421
(edk2/x64: re-enable legacy kernel loader [rhel-10.2.z])
- Resolves: RHEL-165699
(CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2])
[20251114-5.el10_2.1]
- edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573]
- Resolves: RHEL-161573
(CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2])
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | edk2-aarch64 | 0:20251114-5.0.1.el10_2.2 |
| Oracle Linux · 10 | edk2-ovmf | 0:20251114-5.0.1.el10_2.2 |
| Oracle Linux · 10 | edk2-tools | 0:20251114-5.0.1.el10_2.2 |
| Oracle Linux · 10 | edk2-tools-doc | 0:20251114-5.0.1.el10_2.2 |
Vulnerabilities 2
-
High 7.5
Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo
Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptograph…
-
High 7.5
Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous ex…