Lucene search

K
osvGoogleOSV:ALSA-2023:6330
HistoryNov 07, 2023 - 12:00 a.m.

Moderate: edk2 security, bug fix, and enhancement update

2023-11-0700:00:00
Google
osv.dev
8
edk2
uefi
security update
cve-2019-14560
cve-2023-2650
almalinux

7.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.2%

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

Security Fix(es):

  • edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() (CVE-2019-14560)
  • openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.