Published: 15/09/2020 Updated: 12/02/2023

CVSS v2 Base Score: 3.3 | Impact Score: 4.9 | Exploitability Score: 3.4

CVSS v3 Base Score: 6 | Impact Score: 5.2 | Exploitability Score: 0.8

VMScore: 294

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:N

A PGP signature verification bypass has been found in fwupd before 1.4.0, and in libjcat <= 0.1.2. The issue is that if a detached signature is actually a PGP message, gpgme_op_verify() returns the rather perplexing GPG_ERR_NO_ERROR, and then gpgme_op_verify_result() builds an empty list.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat enterprise linux 7.0
redhat enterprise linux 8.0

Synopsis Low: gnome-software and fwupd security, bug fix, and enhancement update Type/Severity Security Advisory: Low Topic An update for appstream-data, fwupd, gnome-software, and libxmlb is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security imp ...

Debian Bug report logs - #962517 CVE-2020-10759 Package: src:fwupd; Maintainer for src:fwupd is Debian EFI <debian-efi@listsdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Tue, 9 Jun 2020 08:03:01 UTC Severity: grave Tags: security Reply or subscribe to this bug Toggle useless messagesVie ...

fwupd could be made to install an unsigned firmware ...

A PGP signature verification bypass has been found in fwupd prior to 140, and in libjcat <= 012 The issue is that if a detached signature is actually a PGP message, gpgme_op_verify() returns the rather perplexing GPG_ERR_NO_ERROR, and then gpgme_op_verify_result() builds an empty list ...

Proof of Concept for CVE-2020-10759 (fwupd signature validation bypass)

Summary Exploits CVE-2020-10759 - fwupd PGP signature verification bypass See githubcom/justinsteven/advisories/blob/master/2020_fwupd_dangling_s3_bucket_and_CVE-2020-10759_signature_verification_bypassmd for more details Requirements Note: You need to install python3-gpg from your OS vendor This module doesn't like being installed via pip because it needs to

CWE-347 https://bugzilla.redhat.com/show_bug.cgi?id=1844316 https://github.com/justinsteven/advisories/blob/master/2020_fwupd_dangling_s3_bucket_and_CVE-2020-10759_signature_verification_bypass.md https://access.redhat.com/errata/RHSA-2020:4436 https://usn.ubuntu.com/4395-1/https://nvd.nist.gov https://security.archlinux.org/CVE-2020-10759

CVE-2020-10759

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect