Low: gnome-software and fwupd security, bug fix, and enhancement update
Summary
ALSA-2020:4436: Low: gnome-software and fwupd security, bug fix, and enhancement update. Affects appstream-data versions < 8-20200724.el8. Fixed in 8-20200724.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gnome-software package is an application that simplifies the process of adding, removing, and updating software in the GNOME desktop environment. It provides a user-friendly interface for managing software installations.
The appstream-data package contains the distribution-specific AppStream metadata required for software centers in GNOME and KDE.
The fwupd package offers a service that enables session software to update device firmware.
These packages have been upgraded to newer versions: gnome-software (3.36.1) and fwupd (1.4.2).
Vulnerability Detail
The fwupd package is affected by a vulnerability identified as CVE-2020-10759. This vulnerability could potentially allow bypassing of signature verification. An attacker could exploit this vulnerability to install malicious firmware on devices, leading to unauthorized access, data compromise, or other malicious activities. The impact of this vulnerability is dependent on the specific usage scenario and the nature of the firmware being updated.
How To Fix
Minimum fixed version
8-20200724.el8
This is the first release that contains the fix.
sudo dnf update appstream-dataTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The gnome-software and fwupd packages have been updated to address security issues, bug fixes, and enhancements. It is crucial to update these packages to the latest versions to mitigate the risk of potential vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for appstream-data →
FAQ
Gnome-software is an application that simplifies software management in the GNOME desktop environment. It provides an easy-to-use interface for installing, removing, and updating software.
Appstream-data is a package that contains distribution-specific AppStream metadata required for software centers in GNOME and KDE. It provides information about available software packages and their descriptions.
Fwupd is a service that allows session software to update device firmware. It provides a mechanism for securely updating firmware on various devices.
The impact of CVE-2020-10759 depends on the specific usage scenario and the nature of the firmware being updated. It could potentially allow bypassing of signature verification, leading to the installation of malicious firmware and unauthorized access to devices.
To fix the vulnerability, it is recommended to update the affected packages to the latest versions. Upgrade gnome-software to version 3.36.1 and fwupd to version 1.4.2 using the package manager or following the instructions provided by your distribution.
Related vulnerabilities
Recent vulnerabilities recorded for appstream-data.
