The grub2 packages provide version 2 of the Grand Unified Bootloader (GRUB), a highly configurable and customizable bootloader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.
A flaw was found in the way the grub2 handled backspace characters entered in username and password prompts. An attacker with access to the system console could use this flaw to bypass grub2 password protection and gain administrative access to the system. (CVE-2015-8370)
This update also fixes the following bug:
All grub2 users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For this update to take effect on BIOS-based machines, grub2 needs to be reinstalled as documented in the "Reinstalling GRUB 2 on BIOS-Based Machines" section of the Red Hat Enterprise Linux 7 System Administrator's Guide linked to in the References section. No manual action is needed on UEFI-based machines.