Skip to content
OpenAdvisories
Medium RHSA-2023:2487 4 CVEs

Red Hat Security Advisory: fwupd security and bug fix update

Published Sep 16, 2024 · Updated Jun 27, 2026

Ecosystem: Red Hat

Fixed packages 15

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream fwupd-debuginfo 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream fwupd-debugsource 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream fwupd-plugin-flashrom 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream fwupd-plugin-flashrom-debuginfo 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream fwupd-tests-debuginfo 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos fwupd 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos fwupd-debuginfo 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos fwupd-debugsource 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos fwupd-plugin-flashrom-debuginfo 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos fwupd-tests-debuginfo 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb fwupd-debuginfo 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb fwupd-debugsource 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb fwupd-devel 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb fwupd-plugin-flashrom-debuginfo 0:1.8.10-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb fwupd-tests-debuginfo 0:1.8.10-2.el9

Vulnerabilities 4

  • Medium 6.5
    CVE-2022-3287

    When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/r…

    fwupd fwupd Debian Ubuntu
  • Unscored —
    CVE-2022-34301 Public exploit

    A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass …

  • Unscored —
    CVE-2022-34302 Public exploit

    A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or…

  • Unscored —
    CVE-2022-34303 Public exploit

    A flaw was found in Eurosoft bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper wit…

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2119436
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2120687
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2120699
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2120701
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2128384
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2129280
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2129904
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2165096
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2487.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-3287
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-3287
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-3287
  • report
    https://access.redhat.com/security/cve/CVE-2022-34301
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-34301
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-34301
  • article
    https://eclypsium.com/2022/08/11/vulnerable-bootloaders-2022/
  • article
    https://kb.cert.org/vuls/id/309662
  • report
    https://access.redhat.com/security/cve/CVE-2022-34302
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-34302
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-34302
  • report
    https://access.redhat.com/security/cve/CVE-2022-34303
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-34303
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-34303