Red Hat Security Advisory: shim and fwupd security update

Fixed packages 9

Vulnerabilities 7

• Unscored —
  CVE-2020-14372 Public exploit

  A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Se…

  grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux Alpine
  Mar 3, 2021
• Unscored —
  CVE-2020-25632 Public exploit

  A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as …

  grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux Alpine
  Mar 3, 2021
• Unscored —
  CVE-2020-25647

  A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very l…

  grub2 grub2 grub Debian Azure Linux Alpine
  Mar 3, 2021
• Unscored —
  CVE-2020-27749

  A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line i…

  grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux Alpine
  Mar 3, 2021
• Unscored —
  CVE-2020-27779

  A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an …

  grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux Alpine
  Mar 3, 2021
• Unscored —
  CVE-2021-20225

  A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a he…

  grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux Alpine
  Mar 3, 2021
• Unscored —
  CVE-2021-20233 Public exploit

  A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length cal…

  grub2 grub2-signed grub2-unsigned grub2 Debian Ubuntu Azure Linux Alpine
  Mar 3, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2021-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1873150
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1879577
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1886936
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1899966
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1900698
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1924696
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1926263
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3675.json
• report
  https://access.redhat.com/security/cve/CVE-2020-14372
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-14372
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-14372
• report
  https://access.redhat.com/security/cve/CVE-2020-25632
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-25632
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-25632
• report
  https://access.redhat.com/security/cve/CVE-2020-25647
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-25647
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-25647
• report
  https://access.redhat.com/security/cve/CVE-2020-27749
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-27749
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-27749
• report
  https://access.redhat.com/security/cve/CVE-2020-27779
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-27779
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-27779
• report
  https://access.redhat.com/security/cve/CVE-2021-20225
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20225
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20225
• report
  https://access.redhat.com/security/cve/CVE-2021-20233
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20233
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20233