Red Hat Security Advisory

RHSA-2023:4128

edk2 security update

Released 2023-07-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.8.6) edk2-20220126gitbb1bba3d77-2.el8_6.1, edk2-aarch64-20220126gitbb1bba3d77-2.el8_6.1, edk2-ovmf-20220126gitbb1bba3d77-2.el8_6.1

Fixes 3 records

TI-2023-00271 CVE-2023-0286 · GHSA-x4qr-2fvf-3mr5

X.400 address type confusion in X.509 GeneralName

HIGH 70

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.69286 Published 2023-02-08 Partial fix · 3.0.8, 1.1.1t +4 CWE-843

TI-2023-00208 CVE-2023-0215 · GHSA-r7jw-wp68-3xch

Use-after-free following BIO_new_NDEF

MEDIUM 47

The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05024 Published 2023-02-08 Partial fix · 3.0.8, 1.1.1t +3 CWE-416

TI-2022-03942 CVE-2022-4304 · GHSA-p52g-cm5j-mjv4

Timing Oracle in RSA Decryption

MEDIUM 47

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.23509 Published 2023-02-08 Partial fix · 3.0.8, 1.1.1t +3 CWE-203