Red Hat Security Advisory

RHSA-2024:4419

edk2 security update

Released 2024-07-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder EUS (v.9.2) edk2-aarch64-20221207gitfff6d81270b5-9.el9_2.3, edk2-ovmf-20221207gitfff6d81270b5-9.el9_2.3, edk2-tools-20221207gitfff6d81270b5-9.el9_2.3 +1
Red Hat Enterprise Linux AppStream EUS (v.9.2) edk2-20221207gitfff6d81270b5-9.el9_2.3, edk2-aarch64-20221207gitfff6d81270b5-9.el9_2.3, edk2-ovmf-20221207gitfff6d81270b5-9.el9_2.3

TI-2023-24240 CVE-2023-45235 · GHSA-h9v6-q439-p7j2

HIGH 79

EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.01223 Published 2024-01-16 Fixed CWE-119

TI-2023-24236 CVE-2023-45231 · GHSA-pr27-mhpp-2ccr

MEDIUM 62

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00849 Published 2024-01-16 Fixed CWE-125

TI-2023-24242 CVE-2023-45237 · GHSA-fxqf-p2p3-gxvr

MEDIUM 41

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00994 Published 2024-01-16 Fixed CWE-338

TI-2023-24241 CVE-2023-45236 · GHSA-fqc4-ffq5-4r98

MEDIUM 41

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00994 Published 2024-01-16 Fixed CWE-200

TI-2023-24234 CVE-2023-45229

LOW 31

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00972 Published 2024-01-16 Fixed CWE-125