RHSA-2023:2487 — Security Advisory
Red Hat Security Advisory: fwupd security and bug fix update
Severity
ModerateRed Hat Product Security
Products
Official CSAF product identity
Published · May 9, 2023
Updated · June 27, 2026
Topic
An update for fwupd is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The fwupd packages provide a service that allows session software to update device firmware.
Security Fix(es):
-
fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287)
-
shim: 3rd party shim allow secure boot bypass (CVE-2022-34301)
-
shim: 3rd party shim allow secure boot bypass (CVE-2022-34302)
-
shim: 3rd party shim allow secure boot bypass (CVE-2022-34303)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.