Summary
The gnome-software packages contain an application that makes it easy to add, remove, and update software in the GNOME desktop.
The appstream-data package provides the distribution specific AppStream metadata required for the GNOME and KDE software centers.
The fwupd packages provide a service that allows session software to update device firmware.
The following packages have been upgraded to a later upstream version: gnome-software (3.36.1), fwupd (1.4.2).
Security Fix(es):
* fwupd: Possible bypass in signature verification (CVE-2020-10759)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | appstream-data | 0:8-20200724.el8 |
| Rocky Linux · 8 | libxmlb | 0:0.1.15-1.el8 |
Vulnerabilities 1
-
Unscored —CVE-2020-10759 Public exploit
A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmwar…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1797932
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1815502
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1839774
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1844316
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1844488
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1845714