ALSA-2024:9088

Dashboard / Vulnerabilities / ALSA-2024:9088

ALSA-2024:9088

Summary: Moderate: edk2 security update

Details: EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * mysql: openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129) * openssl: Excessive time spent checking invalid RSA public keys (CVE-2023-6237) * openssl: denial of service via null dereference (CVE-2024-0727) * edk2: Temporary DoS vulnerability (CVE-2024-1298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References: https://access.redhat.com/errata/RHSA-2024:9088, https://access.redhat.com/security/cve/CVE-2023-6129, https://access.redhat.com/security/cve/CVE-2023-6237, https://access.redhat.com/security/cve/CVE-2024-0727, https://access.redhat.com/security/cve/CVE-2024-1298, https://bugzilla.redhat.com/2257571, https://bugzilla.redhat.com/2258502, https://bugzilla.redhat.com/2259944, https://bugzilla.redhat.com/2284243, https://errata.almalinux.org/9/ALSA-2024-9088.html