Red Hat Security Advisory: edk2 security, bug fix, and enhancement update

Fixed packages 3

Vulnerabilities 4

• High 7.5
  CVE-2021-23840 Public exploit EPSS 51%

  Integer overflow in CipherUpdate

  Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  Feb 16, 2021
• Medium 5.9
  CVE-2021-23841 Public exploit

  Null pointer deref in X509_issuer_and_serial_hash()

  The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  Feb 16, 2021
• Unscored —
  CVE-2019-14584

  Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privileg…

  edk2 edk2 shim-unsigned-x64 shim-unsigned-aarch64 Debian Ubuntu Azure Linux
  Jun 3, 2021
• Unscored —
  CVE-2021-28210

  An unlimited recursion in DxeCore in EDK II.

  TianoCore EDK II edk2 edk2 Debian Ubuntu
  Jun 11, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1930310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1930324
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1937564
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1938238
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1938257
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956837
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1988762
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4198.json
• report
  https://access.redhat.com/security/cve/CVE-2019-14584
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1889486
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-14584
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-14584
• report
  https://access.redhat.com/security/cve/CVE-2021-23840
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23840
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23840
• article
  https://www.openssl.org/news/secadv/20210216.txt
• report
  https://access.redhat.com/security/cve/CVE-2021-23841
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23841
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23841
• report
  https://access.redhat.com/security/cve/CVE-2021-28210
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1883552
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-28210
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-28210