OESA-2026-3419

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3419

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-3419.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-3419

Upstream

CVE-2024-41996

Published

2026-08-20T09:55:10Z

Modified

2026-08-20T10:15:07.713742627Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

edk2 security update

Details

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.

Security Fix(es):

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.(CVE-2024-41996)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:24.03-LTS-SP1 / edk2

Package

Name: edk2
Purl: pkg:rpm/openEuler/edk2&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

202308-43.oe2403sp1

Ecosystem specific

{
    "x86_64": [
        "edk2-debuginfo-202308-43.oe2403sp1.x86_64.rpm",
        "edk2-debugsource-202308-43.oe2403sp1.x86_64.rpm",
        "edk2-devel-202308-43.oe2403sp1.x86_64.rpm"
    ],
    "aarch64": [
        "edk2-debuginfo-202308-43.oe2403sp1.aarch64.rpm",
        "edk2-debugsource-202308-43.oe2403sp1.aarch64.rpm",
        "edk2-devel-202308-43.oe2403sp1.aarch64.rpm"
    ],
    "src": [
        "edk2-202308-43.oe2403sp1.src.rpm"
    ],
    "noarch": [
        "edk2-aarch64-202308-43.oe2403sp1.noarch.rpm",
        "edk2-help-202308-43.oe2403sp1.noarch.rpm",
        "edk2-ovmf-202308-43.oe2403sp1.noarch.rpm",
        "python3-edk2-devel-202308-43.oe2403sp1.noarch.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-3419.json"