(RHSA-2024:3497) Important: edk2 security update

2024-05-3012:07:00

access.redhat.com

edk2

uefi

virtual machines

buffer overflow

dhcpv6

security update

7.4 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

20.2%

JSON

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual
Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

Security Fix(es):

edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message (CVE-2023-45234)
edk2: Buffer overflow in the DHCPv6 client via a long Server ID option (CVE-2023-45230)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

OSVersionArchitecturePackageVersionFilename
RedHat8noarchedk2-ovmf< 20220126gitbb1bba3d77-2.el8_6.4edk2-ovmf-20220126gitbb1bba3d77-2.el8_6.4.noarch.rpm
RedHat8noarchedk2-aarch64< 20220126gitbb1bba3d77-2.el8_6.4edk2-aarch64-20220126gitbb1bba3d77-2.el8_6.4.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	8	noarch	edk2-ovmf	< 20220126gitbb1bba3d77-2.el8_6.4	edk2-ovmf-20220126gitbb1bba3d77-2.el8_6.4.noarch.rpm
RedHat	8	noarch	edk2-aarch64	< 20220126gitbb1bba3d77-2.el8_6.4	edk2-aarch64-20220126gitbb1bba3d77-2.el8_6.4.noarch.rpm