Описание
ELSA-2026-39297: edk2 security, bug fix, and enhancement update (MODERATE)
[20251114-5.0.1.el10_2.2]
- Replace upstream references [Orabug:36569119]
[20251114-5.el10_2.2]
- edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421]
- edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699]
- Resolves: RHEL-182421 (edk2/x64: re-enable legacy kernel loader [rhel-10.2.z])
- Resolves: RHEL-165699 (CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2])
[20251114-5.el10_2.1]
- edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573]
- Resolves: RHEL-161573 (CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2])
Обновленные пакеты
Oracle Linux 10
Oracle Linux aarch64
edk2-aarch64
20251114-5.0.1.el10_2.2
edk2-ovmf
20251114-5.0.1.el10_2.2
edk2-tools
20251114-5.0.1.el10_2.2
edk2-tools-doc
20251114-5.0.1.el10_2.2
Oracle Linux x86_64
edk2-aarch64
20251114-5.0.1.el10_2.2
edk2-ovmf
20251114-5.0.1.el10_2.2
edk2-tools
20251114-5.0.1.el10_2.2
edk2-tools-doc
20251114-5.0.1.el10_2.2
Связанные CVE
Связанные уязвимости
Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker i...
Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker i...