Summary
Justin Steven discovered that fwupd incorrectly handled certain signature
verification. An attacker could possibly use this issue to install an unsigned
firmware.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | fwupd | 0.8.3-0ubuntu5.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | fwupd | 1.2.10-1ubuntu2~ubuntu18.04.5 |
| Ubuntu · 20.04 LTS 20.04:LTS | fwupd | 1.3.9-4ubuntu0.1 |
Vulnerabilities 1
-
Unscored —CVE-2020-10759 Public exploit
A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmwar…
References
-
report
https://ubuntu.com/security/CVE-2020-10759