openSUSE-SU-2021:0598-1

    Dashboard / Vulnerabilities / openSUSE-SU-2021:0598-1

    openSUSE-SU-2021:0598-1

    Published: 23 Apr 2021Last Modified: 4 Feb 2026
    Upstream:
    CVE-2019-14584

    Summary: Security update for shim

    Details: This update for shim fixes the following issues: - Updated openSUSE x86 signature - Avoid the error message during linux system boot (boo#1184454) - Prevent the build id being added to the binary. That can cause issues with the signature Update to 15.4 (boo#1182057) + Rename the SBAT variable and fix the self-check of SBAT + sbat: add more dprint() + arm/aa64: Swizzle some sections to make old sbsign happier + arm/aa64 targets: put .rel* and .dyn* in .rodata - Change the SBAT variable name and enhance the handling of SBAT (boo#1182057) Update to 15.3 for SBAT support (boo#1182057) + Drop gnu-efi from BuildRequires since upstream pull it into the - Generate vender-specific SBAT metadata + Add dos2unix to BuildRequires since Makefile requires it for vendor SBAT - Update dbx-cert.tar.xz and vendor-dbx.bin to block the following sign keys: + SLES-UEFI-SIGN-Certificate-2020-07.crt + openSUSE-UEFI-SIGN-Certificate-2020-07.crt - Check CodeSign in the signer's EKU (boo#1177315) - Fixed NULL pointer dereference in AuthenticodeVerify() (boo#1177789, CVE-2019-14584) - All newly released openSUSE kernels enable kernel lockdown and signature verification, so there is no need to add the prompt anymore. - shim-install: Support changing default shim efi binary in /usr/etc/default/shim and /etc/default/shim (boo#1177315)

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/O2IF5TPLLS7U2RNC42HXIHTRUMS4Q6YV/, https://bugzilla.suse.com/1173411, https://bugzilla.suse.com/1174512, https://bugzilla.suse.com/1175509, https://bugzilla.suse.com/1177315, https://bugzilla.suse.com/1177404, https://bugzilla.suse.com/1177789, https://bugzilla.suse.com/1182057, https://bugzilla.suse.com/1184454, https://www.suse.com/security/cve/CVE-2019-14584

    Affected packages

    Package

    Name: shim

    Purl: pkg:rpm/opensuse/shim&distro=openSUSE%20Leap%2015.2

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -15.4-lp152.4.8.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    openSUSE-SU-2021:0598-1 | CVE-DB