OESA-2026-1834

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1834
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-1834.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-1834
Upstream
Published
2026-04-11T11:10:51Z
Modified
2026-08-18T01:19:45.907977510Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
uboot-tools security update
Details

This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fwprintenv and fwsetenv programs to read and modify U-Boot's environment.

Security Fix(es):

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.(CVE-2026-33243)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP4
uboot-tools

Package

Name
uboot-tools
Purl
pkg:rpm/openEuler/uboot-tools&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2020.07-10.oe2003sp4

Ecosystem specific 

{
    "src": [
        "uboot-tools-2020.07-10.oe2003sp4.src.rpm"
    ],
    "noarch": [
        "uboot-images-armv8-2020.07-10.oe2003sp4.noarch.rpm",
        "uboot-tools-help-2020.07-10.oe2003sp4.noarch.rpm"
    ],
    "aarch64": [
        "uboot-images-elf-2020.07-10.oe2003sp4.aarch64.rpm",
        "uboot-tools-2020.07-10.oe2003sp4.aarch64.rpm",
        "uboot-tools-debuginfo-2020.07-10.oe2003sp4.aarch64.rpm",
        "uboot-tools-debugsource-2020.07-10.oe2003sp4.aarch64.rpm"
    ],
    "x86_64": [
        "uboot-tools-2020.07-10.oe2003sp4.x86_64.rpm",
        "uboot-tools-debuginfo-2020.07-10.oe2003sp4.x86_64.rpm",
        "uboot-tools-debugsource-2020.07-10.oe2003sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1834.json"
openEuler:22.03-LTS-SP4
uboot-tools

Package

Name
uboot-tools
Purl
pkg:rpm/openEuler/uboot-tools&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2021.10-11.oe2203sp4

Ecosystem specific 

{
    "src": [
        "uboot-tools-2021.10-11.oe2203sp4.src.rpm"
    ],
    "noarch": [
        "uboot-images-armv8-2021.10-11.oe2203sp4.noarch.rpm",
        "uboot-tools-help-2021.10-11.oe2203sp4.noarch.rpm"
    ],
    "aarch64": [
        "uboot-images-elf-2021.10-11.oe2203sp4.aarch64.rpm",
        "uboot-tools-2021.10-11.oe2203sp4.aarch64.rpm",
        "uboot-tools-debuginfo-2021.10-11.oe2203sp4.aarch64.rpm",
        "uboot-tools-debugsource-2021.10-11.oe2203sp4.aarch64.rpm"
    ],
    "x86_64": [
        "uboot-tools-2021.10-11.oe2203sp4.x86_64.rpm",
        "uboot-tools-debuginfo-2021.10-11.oe2203sp4.x86_64.rpm",
        "uboot-tools-debugsource-2021.10-11.oe2203sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1834.json"
openEuler:24.03-LTS
uboot-tools

Package

Name
uboot-tools
Purl
pkg:rpm/openEuler/uboot-tools&distro=openEuler-24.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2024.01-3.oe2403sp2

Ecosystem specific 

{
    "src": [
        "uboot-tools-2024.01-3.oe2403sp3.src.rpm",
        "uboot-tools-2024.01-3.oe2403.src.rpm",
        "uboot-tools-2024.01-3.oe2403sp1.src.rpm",
        "uboot-tools-2024.01-3.oe2403sp2.src.rpm"
    ],
    "noarch": [
        "uboot-images-armv8-2024.01-3.oe2403sp3.noarch.rpm",
        "uboot-tools-help-2024.01-3.oe2403sp3.noarch.rpm",
        "uboot-images-armv8-2024.01-3.oe2403.noarch.rpm",
        "uboot-tools-help-2024.01-3.oe2403.noarch.rpm",
        "uboot-images-armv8-2024.01-3.oe2403sp1.noarch.rpm",
        "uboot-tools-help-2024.01-3.oe2403sp1.noarch.rpm",
        "uboot-images-armv8-2024.01-3.oe2403sp2.noarch.rpm",
        "uboot-tools-help-2024.01-3.oe2403sp2.noarch.rpm"
    ],
    "aarch64": [
        "uboot-images-elf-2024.01-3.oe2403sp3.aarch64.rpm",
        "uboot-tools-2024.01-3.oe2403sp3.aarch64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403sp3.aarch64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403sp3.aarch64.rpm",
        "uboot-images-elf-2024.01-3.oe2403.aarch64.rpm",
        "uboot-tools-2024.01-3.oe2403.aarch64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403.aarch64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403.aarch64.rpm",
        "uboot-images-elf-2024.01-3.oe2403sp1.aarch64.rpm",
        "uboot-tools-2024.01-3.oe2403sp1.aarch64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403sp1.aarch64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403sp1.aarch64.rpm",
        "uboot-images-elf-2024.01-3.oe2403sp2.aarch64.rpm",
        "uboot-tools-2024.01-3.oe2403sp2.aarch64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403sp2.aarch64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403sp2.aarch64.rpm"
    ],
    "x86_64": [
        "uboot-tools-2024.01-3.oe2403sp3.x86_64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403sp3.x86_64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403sp3.x86_64.rpm",
        "uboot-tools-2024.01-3.oe2403.x86_64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403.x86_64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403.x86_64.rpm",
        "uboot-tools-2024.01-3.oe2403sp1.x86_64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403sp1.x86_64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403sp1.x86_64.rpm",
        "uboot-tools-2024.01-3.oe2403sp2.x86_64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403sp2.x86_64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403sp2.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1834.json"
openEuler:24.03-LTS-SP1
uboot-tools

Package

Name
uboot-tools
Purl
pkg:rpm/openEuler/uboot-tools&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2024.01-3.oe2403sp1

Ecosystem specific 

{
    "src": [
        "uboot-tools-2024.01-3.oe2403sp1.src.rpm"
    ],
    "noarch": [
        "uboot-images-armv8-2024.01-3.oe2403sp1.noarch.rpm",
        "uboot-tools-help-2024.01-3.oe2403sp1.noarch.rpm"
    ],
    "aarch64": [
        "uboot-images-elf-2024.01-3.oe2403sp1.aarch64.rpm",
        "uboot-tools-2024.01-3.oe2403sp1.aarch64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403sp1.aarch64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403sp1.aarch64.rpm"
    ],
    "x86_64": [
        "uboot-tools-2024.01-3.oe2403sp1.x86_64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403sp1.x86_64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403sp1.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1834.json"
openEuler:24.03-LTS-SP2
uboot-tools

Package

Name
uboot-tools
Purl
pkg:rpm/openEuler/uboot-tools&distro=openEuler-24.03-LTS-SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2024.01-3.oe2403sp2

Ecosystem specific 

{
    "src": [
        "uboot-tools-2024.01-3.oe2403sp2.src.rpm"
    ],
    "noarch": [
        "uboot-images-armv8-2024.01-3.oe2403sp2.noarch.rpm",
        "uboot-tools-help-2024.01-3.oe2403sp2.noarch.rpm"
    ],
    "aarch64": [
        "uboot-images-elf-2024.01-3.oe2403sp2.aarch64.rpm",
        "uboot-tools-2024.01-3.oe2403sp2.aarch64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403sp2.aarch64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403sp2.aarch64.rpm"
    ],
    "x86_64": [
        "uboot-tools-2024.01-3.oe2403sp2.x86_64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403sp2.x86_64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403sp2.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1834.json"
openEuler:24.03-LTS-SP3
uboot-tools

Package

Name
uboot-tools
Purl
pkg:rpm/openEuler/uboot-tools&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2024.01-3.oe2403sp3

Ecosystem specific 

{
    "src": [
        "uboot-tools-2024.01-3.oe2403sp3.src.rpm"
    ],
    "noarch": [
        "uboot-images-armv8-2024.01-3.oe2403sp3.noarch.rpm",
        "uboot-tools-help-2024.01-3.oe2403sp3.noarch.rpm"
    ],
    "aarch64": [
        "uboot-images-elf-2024.01-3.oe2403sp3.aarch64.rpm",
        "uboot-tools-2024.01-3.oe2403sp3.aarch64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403sp3.aarch64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403sp3.aarch64.rpm"
    ],
    "x86_64": [
        "uboot-tools-2024.01-3.oe2403sp3.x86_64.rpm",
        "uboot-tools-debuginfo-2024.01-3.oe2403sp3.x86_64.rpm",
        "uboot-tools-debugsource-2024.01-3.oe2403sp3.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1834.json"