grub2, mokutil, shim security update

CentOS Errata and Security Advisory CESA-2020:3217 An update for grub2, shim, shim-signed, and fwupdate is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score,...

CentOS: Security Advisory for shim-unsigned-ia32 (CESA-2020:3217)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

kernel security and bug fix update

4.18.0-193.14.32.OL8 - Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x6...

grub2: Fail kernel validation without shim protocol

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim...

grub2: Fail kernel validation without shim protocol

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim...

grub2: Fail kernel validation without shim protocol

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim...

Moderate: Red Hat Security Advisory: grub2 security update

An update for grub2, shim, shim-unsigned-x64, and fwupd is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

grub2: Fail kernel validation without shim protocol

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim...

CVE-2020-15705

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim...

ALPINE-CVE-2020-15705

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim...

UBUNTU-CVE-2020-15705

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim...

CVE-2020-15705

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim...

GRUB2 bootloader is vulnerable to buffer overflow

Overview The GRUB2 boot loader is vulnerable to buffer overflow, which results in arbitrary code execution during the boot process, even when Secure Boot is enabled. Description GRUB2 is a multiboot boot loader that replaced GRUB Legacy in 2012. A boot loader is the first program that runs upon...

@hpcc-js/dgrid-shim (>=0.1.10, <=0.1.12) potentially affected by CVE-2020-5259 via dojox (1.13.0)

dojox NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - @hpcc-js/dgrid-shim =0.1.10, =0.1.12 Source cves: CVE-2020-5259 Source advisory: OSV:GHSA-3HW5-Q855-G6CW...

@hpcc-js/dgrid-shim (>=0.1.10, <=0.1.12) potentially affected by CVE-2020-5259 via dojox (1.13.0)

dojox NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - @hpcc-js/dgrid-shim =0.1.10, =0.1.12 Source cves: CVE-2020-5259 Source advisory: SNYK:JS-DOJOX-559225...

@hpcc-js/dgrid-shim (>=0.1.10, <=0.1.12) potentially affected by CVE-2019-10785 via dojox (1.13.0)

dojox NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - @hpcc-js/dgrid-shim =0.1.10, =0.1.12 Source cves: CVE-2019-10785 Source advisory: OSV:GHSA-PG97-WW7H-5MJR...

@hpcc-js/dgrid-shim (>=0.1.10, <=0.1.12), bryaktestgrid (>=0.0.1, <=0.0.6) +2 more potentially affected by CVE-2019-10785 via dojox (>=1.11.2, <=1.13.0)

dojox NPM version =1.11.2, =0.1.10, =0.0.1, =0.1.0, =0.0.1, =0.5.24 Source cves: CVE-2019-10785 Source advisory: SNYK:JS-DOJOX-548257...

Sandbox Breakout in realms-shim

Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting...

GHSA-7CG8-PQ9V-X98Q Sandbox Breakout in realms-shim

Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting...

Sandbox Breakout

realms-shim is vulnerable to sandbox breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. An attacker is able to provide a malicious rewriter function that uses the confined code used within the evaluator...