REDHAT-BUG-1844316: Low severity red hat enterprise linux vulnerability
A PGP signature bypass was found in fwupd, which could lead to possible installation of unsigned firmware.
As per upstream:
For Red Hat Enterprise Linux 7: LVFS (LVFS (Linux Vendor Firmware Service) is: a secure portal which allows hardware vendors to upload firmware updates. The site is used by all major Linux distributions to provide metadata for clients such as fwupdmgr and GNOME Software.) was never enabled there although the PGP bypass is possible but not implementable.
For Red Hat Enterprise Linux 8: The LVFS is disabled and never used the Amazon CDN. PGP bypass possible, but not implementable.
More information available at: https://bugzilla.redhat.com/showbug.cgi?id=1841462
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1844316?
The severity of REDHAT-BUG-1844316 is considered high due to the potential risk of installing unsigned firmware.
How do I fix REDHAT-BUG-1844316?
To fix REDHAT-BUG-1844316, ensure that you update the fwupd to the latest version provided by Red Hat.
Which versions of Red Hat Enterprise Linux are affected by REDHAT-BUG-1844316?
Red Hat Enterprise Linux versions 7 and 8 are affected by REDHAT-BUG-1844316.
What are the implications of REDHAT-BUG-1844316?
The implications of REDHAT-BUG-1844316 include the potential for unauthorized firmware installations, compromising system integrity.
Is fwupd the only software affected by REDHAT-BUG-1844316?
Yes, fwupd is the primary software affected by REDHAT-BUG-1844316 in the context of Red Hat Enterprise Linux.