debian/fwupd vulnerabilities

Latest debian/fwupd CVEs

Newest publication first

1. CVE-2022-3287 When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read t...

   Published 2022-09-28

   Medium·CVSS 6.5 EPSS 0.83%

   When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.

2. CVE-2020-10759 A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practic...

   Published 2020-09-15

   Medium·CVSS 6.0 EPSS 0.49%

   A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or...

3. DLA-2274-1 fwupd - security update

   Published 2020-07-09

   Unknown

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.