RLSA-2021:4198
Dashboard / Vulnerabilities / RLSA-2021:4198
Summary: Moderate: edk2 security, bug fix, and enhancement update
Details: EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. The following packages have been upgraded to a later upstream version: edk2 (20210527gite1999b264f1f). (BZ#1846481, BZ#1938238) Security Fix(es): * openssl: integer overflow in CipherUpdate (CVE-2021-23840) * openssl: NULL pointer dereference in X509_issuer_and_serial_hash() (CVE-2021-23841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.
References: https://errata.rockylinux.org/RLSA-2021:4198, https://bugzilla.redhat.com/show_bug.cgi?id=1930310, https://bugzilla.redhat.com/show_bug.cgi?id=1930324, https://bugzilla.redhat.com/show_bug.cgi?id=1937564, https://bugzilla.redhat.com/show_bug.cgi?id=1938238, https://bugzilla.redhat.com/show_bug.cgi?id=1938257, https://bugzilla.redhat.com/show_bug.cgi?id=1956837, https://bugzilla.redhat.com/show_bug.cgi?id=1988762
Affected packages
Package
Name: edk2
Purl: pkg:rpm/rocky-linux/edk2?distro=rocky-linux-8-5-x86-64-legacy&epoch=0
Affected ranges
Type: ECOSYSTEM
Events:
