edk2 security update

2024-03-0500:00:00

linux.oracle.com

cve-2023-45230

cve-2023-45234

buffer overflow

dhcpv6 client

dns servers option

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

Low

EPSS

0.001

Percentile

20.1%

JSON

[20220126gitbb1bba3d77-6.el8_9.6]

edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21840 RHEL-21842]
edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch [RHEL-21840 RHEL-21842]
Resolves: RHEL-21842
(CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-8])
Resolves: RHEL-21850
(CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8])

OSVersionArchitecturePackageVersionFilename
oracle linux8srcedk2< 20220126gitbb1bba3d77-6.el8_9.6edk2-20220126gitbb1bba3d77-6.el8_9.6.src.rpm
oracle linux8noarchedk2-aarch64< 20220126gitbb1bba3d77-6.el8_9.6edk2-aarch64-20220126gitbb1bba3d77-6.el8_9.6.noarch.rpm
oracle linux8srcedk2< 20220126gitbb1bba3d77-6.el8_9.6edk2-20220126gitbb1bba3d77-6.el8_9.6.src.rpm
oracle linux8noarchedk2-ovmf< 20220126gitbb1bba3d77-6.el8_9.6edk2-ovmf-20220126gitbb1bba3d77-6.el8_9.6.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	8	src	edk2	< 20220126gitbb1bba3d77-6.el8_9.6	edk2-20220126gitbb1bba3d77-6.el8_9.6.src.rpm
oracle linux	8	noarch	edk2-aarch64	< 20220126gitbb1bba3d77-6.el8_9.6	edk2-aarch64-20220126gitbb1bba3d77-6.el8_9.6.noarch.rpm
oracle linux	8	src	edk2	< 20220126gitbb1bba3d77-6.el8_9.6	edk2-20220126gitbb1bba3d77-6.el8_9.6.src.rpm
oracle linux	8	noarch	edk2-ovmf	< 20220126gitbb1bba3d77-6.el8_9.6	edk2-ovmf-20220126gitbb1bba3d77-6.el8_9.6.noarch.rpm