红帽产品勘误 RHSA-2018:3090 - Security Advisory
发布：
2018-10-30
已更新：
2018-10-30

RHSA-2018:3090 - Security Advisory

概述

Moderate: ovmf security, bug fix, and enhancement update

类型/严重性

Security Advisory: Moderate

Red Hat Insights 补丁分析

识别并修复受此公告影响的系统。

查看受影响的系统

标题

An update for ovmf is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

描述

OVMF (Open Virtual Machine Firmware) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

The following packages have been upgraded to a later upstream version: ovmf (20180508). (BZ#1559542)

Security Fix(es):

  • openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service (CVE-2018-0739)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

解决方案

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

受影响的产品

  • Red Hat Enterprise Linux Server 7 x86_64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
  • Red Hat Enterprise Linux for ARM 64 7 aarch64

修复

  • BZ - 1561128 - OVMF Secure boot enablement (enrollment of default keys)
  • BZ - 1561266 - CVE-2018-0739 openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service
  • BZ - 1577546 - no input consoles connected under certain circumstances
  • BZ - 1579518 - EFI_RNG_PROTOCOL no longer produced for virtio-rng
  • BZ - 1607792 - add 'Provides: bundled(openssl) = 1.1.0h' to the spec file

Red Hat Enterprise Linux Server 7

SRPM
ovmf-20180508-3.gitee3198e672e2.el7.src.rpm SHA-256: 6bac7c1c730ddbdac45929f33a0650a0a1f735941658306e406ad7f18b25f5ad
x86_64
OVMF-20180508-3.gitee3198e672e2.el7.noarch.rpm SHA-256: 99b771fbac9e0d55539559217918fb43ccbf44a81dd4b10e590d8616ffa4f15a

Red Hat Enterprise Linux Server - Extended Life Cycle Support 7

SRPM
ovmf-20180508-3.gitee3198e672e2.el7.src.rpm SHA-256: 6bac7c1c730ddbdac45929f33a0650a0a1f735941658306e406ad7f18b25f5ad
x86_64
OVMF-20180508-3.gitee3198e672e2.el7.noarch.rpm SHA-256: 99b771fbac9e0d55539559217918fb43ccbf44a81dd4b10e590d8616ffa4f15a

Red Hat Enterprise Linux for ARM 64 7

SRPM
ovmf-20180508-3.gitee3198e672e2.el7.src.rpm SHA-256: 6bac7c1c730ddbdac45929f33a0650a0a1f735941658306e406ad7f18b25f5ad
aarch64
AAVMF-20180508-3.gitee3198e672e2.el7.noarch.rpm SHA-256: 84edcf5bf28430905d7fbfcc59b5e10c5af05b90f34816dc0e83749794696667

Red Hat 安全团队联络方式为 secalert@redhat.com。 更多联络细节请参考 https://access.redhat.com/security/team/contact/。