Low: gnome-software and fwupd security, bug fix, and enhancement update
Summary
RLSA-2020:4436: Low: gnome-software and fwupd security, bug fix, and enhancement update. Affects appstream-data versions < 0:8-20200724.el8. Fixed in 0:8-20200724.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gnome-software package is an application that simplifies the process of adding, removing, and updating software in the GNOME desktop environment. It provides a user-friendly interface for managing software packages.
The appstream-data package contains distribution-specific AppStream metadata required for software centers in GNOME and KDE.
The fwupd package offers a service that enables session software to update device firmware.
These packages have been upgraded to newer versions: gnome-software (3.36.1) and fwupd (1.4.2).
Vulnerability Detail
The fwupd package is affected by a vulnerability identified as CVE-2020-10759. This vulnerability could potentially allow an attacker to bypass signature verification. The impact of this vulnerability is rated as low, with a CVSS score of 5.7. Further details about the vulnerability, including its technical aspects and potential consequences, can be found on the CVE page linked in the References section.
How To Fix
Minimum fixed version
0:8-20200724.el8
This is the first release that contains the fix.
sudo dnf update appstream-dataTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the gnome-software and fwupd packages have been updated to address a low-severity vulnerability. Users are advised to update their packages to the latest versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for appstream-data →
FAQ
Gnome-software is an application that simplifies software management in the GNOME desktop environment. It provides an easy way to add, remove, and update software packages.
Appstream-data is a package that contains distribution-specific AppStream metadata required for software centers in GNOME and KDE.
Fwupd is a service that allows session software to update device firmware.
The impact of this vulnerability is rated as low, with a CVSS score of 5.7. It could potentially allow an attacker to bypass signature verification.
To fix this vulnerability, it is recommended to update the affected packages to the latest versions. Users should upgrade gnome-software to version 3.36.1 and fwupd to version 1.4.2.
References
Related vulnerabilities
Recent vulnerabilities recorded for appstream-data.
