UBUNTU-CVE-2020-10759

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2020-10759

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-10759.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2020-10759

Related

Published

2020-06-09T00:00:00Z

Modified

2020-06-09T00:00:00Z

Severity

6.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. The highest threat from this vulnerability is to confidentiality and integrity.

References

Affected packages

Ubuntu:16.04:LTS / fwupd

Package

Name: fwupd
Purl: pkg:deb/ubuntu/fwupd?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.8.3-0ubuntu5.1

Affected versions

0.*

0.1.5-0ubuntu3

0.6.0-1

0.6.2-1

0.6.2-1ubuntu1

0.6.2-1ubuntu2

0.6.2-1ubuntu3

0.6.3-0ubuntu2

0.7.0-0ubuntu2

0.7.0-0ubuntu3

0.7.0-0ubuntu4

0.7.0-0ubuntu4.1

0.7.0-0ubuntu4.2

0.7.0-0ubuntu4.3

0.8.3-0ubuntu2

0.8.3-0ubuntu3

0.8.3-0ubuntu4

0.8.3-0ubuntu5

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "0.8.3-0ubuntu5.1",
            "binary_name": "fwupd"
        },
        {
            "binary_version": "0.8.3-0ubuntu5.1",
            "binary_name": "fwupd-dbgsym"
        },
        {
            "binary_version": "0.8.3-0ubuntu5.1",
            "binary_name": "libdfu-dev"
        },
        {
            "binary_version": "0.8.3-0ubuntu5.1",
            "binary_name": "libdfu1"
        },
        {
            "binary_version": "0.8.3-0ubuntu5.1",
            "binary_name": "libdfu1-dbgsym"
        },
        {
            "binary_version": "0.8.3-0ubuntu5.1",
            "binary_name": "libfwupd-dev"
        },
        {
            "binary_version": "0.8.3-0ubuntu5.1",
            "binary_name": "libfwupd1"
        },
        {
            "binary_version": "0.8.3-0ubuntu5.1",
            "binary_name": "libfwupd1-dbgsym"
        }
    ]
}

Ubuntu:18.04:LTS / fwupd

Package

Name: fwupd
Purl: pkg:deb/ubuntu/fwupd?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.10-1ubuntu2~ubuntu18.04.5

Affected versions

0.*

0.9.7-2

1.*

1.0.0-4

1.0.0-5

1.0.1-2

1.0.2-1

1.0.4-3

1.0.4-3build1

1.0.5-1

1.0.6-2

1.0.9-0ubuntu2

1.2.10-1ubuntu2~ubuntu18.04.3

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "fwupd"
        },
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "fwupd-amd64-signed-template"
        },
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "fwupd-arm64-signed-template"
        },
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "fwupd-armhf-signed-template"
        },
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "fwupd-dbgsym"
        },
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "fwupd-doc"
        },
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "fwupd-i386-signed-template"
        },
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "fwupd-tests"
        },
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "fwupd-tests-dbgsym"
        },
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "gir1.2-fwupd-2.0"
        },
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "libfwupd-dev"
        },
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "libfwupd2"
        },
        {
            "binary_version": "1.2.10-1ubuntu2~ubuntu18.04.5",
            "binary_name": "libfwupd2-dbgsym"
        }
    ]
}

Ubuntu:20.04:LTS / fwupd

Package

Name: fwupd
Purl: pkg:deb/ubuntu/fwupd?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.9-4ubuntu0.1

Affected versions

1.*

1.2.10-1ubuntu2

1.3.3-3

1.3.5-1

1.3.6-1ubuntu1

1.3.7-2

1.3.7-3

1.3.8-1

1.3.9-1

1.3.9-1build1

1.3.9-2

1.3.9-2build1

1.3.9-3

1.3.9-4

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "fwupd"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "fwupd-amd64-signed-template"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "fwupd-arm64-signed-template"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "fwupd-armhf-signed-template"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "fwupd-dbgsym"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "fwupd-doc"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "fwupd-tests"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "fwupd-tests-dbgsym"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "gir1.2-fwupd-2.0"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "gir1.2-fwupdplugin-1.0"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "libfwupd-dev"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "libfwupd2"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "libfwupd2-dbgsym"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "libfwupdplugin-dev"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "libfwupdplugin1"
        },
        {
            "binary_version": "1.3.9-4ubuntu0.1",
            "binary_name": "libfwupdplugin1-dbgsym"
        }
    ]
}