ALSA-2023:1067 - Important: pesign security update
Summary
ALSA-2023:1067: Important: pesign security update. Affects pesign versions < 115-6.el9_1. Fixed in 115-6.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pesign package provides the pesign utility for signing UEFI binaries and other associated tools. It is commonly used for secure booting and signing of firmware images. The package is a critical component in ensuring the integrity and authenticity of UEFI binaries.
Vulnerability Detail
The vulnerability (CVE-2022-3560) in pesign allows for local privilege escalation on the pesign systemd service. This means that an attacker with local access to the system can exploit the vulnerability to gain elevated privileges and potentially execute arbitrary code. The impact of this vulnerability can be severe, as it allows an attacker to bypass security measures and gain unauthorized control over the system.
How To Fix
Minimum fixed version
115-6.el9_1
This is the first release that contains the fix.
sudo dnf update pesignTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to mitigate the risk.
Conclusion
The pesign package is vulnerable to a local privilege escalation vulnerability. To mitigate the risk, it is crucial to update the package to version 115-6.el9_1 or later. Failure to apply the security update may allow an attacker to gain unauthorized control over the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pesign →
FAQ
Pesign is a utility used for signing UEFI binaries and ensuring their integrity and authenticity.
The vulnerability allows for local privilege escalation, enabling an attacker to gain elevated privileges and potentially execute arbitrary code.
To fix this vulnerability, update the pesign package to version 115-6.el9_1 or later by applying the provided security update.
There is no known workaround for this vulnerability. It is crucial to apply the security update to mitigate the risk.
You can find more information about this vulnerability, including its impact and technical details, on the CVE page associated with CVE-2022-3560.
Related vulnerabilities
Recent vulnerabilities recorded for pesign.
