Bugzilla – Bug 1215101
VUL-0: CVE-2023-40549: shim: Authenticode: verify that the signature header is in bounds.
Last modified: 2024-07-12 09:30:12 UTC
CRD: 2023-12-12
Created attachment 871409 [details] shim commit CVE-2023-40549 from keybase
Created attachment 871508 [details] CVE-2023-40549 codes from keybase
embargo end was shifted again: CRD: 2024-01-23
is public https://github.com/rhboot/shim/releases/tag/15.8
shim-15.8 update has been submitted to Factory for reviewing. Please refer https://build.opensuse.org/request/show/1142576
An update for Shim[1] was released today, but these bugs/CVEs are not mentioned. Are these included in the release? [1]https://lists.suse.com/pipermail/sle-updates/2024-February/034449.html
No, actually this release[1] doesn't cover this CVE. New SUSE shim-15.8 will be submitted to GIT upstream for reviewing, and then sent to Microsoft for signing in the next couple of weeks. Thanks Dennis
(In reply to Brad Bendily from comment #13) > An update for Shim[1] was released today, but these bugs/CVEs are not > mentioned. > Are these included in the release? > > [1]https://lists.suse.com/pipermail/sle-updates/2024-February/034449.html My Bad. I just realized this release is only for SLES12... Not SLES15. But also, even though it says released (shim-15.7-25.24.1) today, we already have shim-15.7-25.27.1.
(In reply to Tseng from comment #14) > No, actually this release[1] doesn't cover this CVE. New SUSE shim-15.8 will > be submitted to GIT upstream for reviewing, and then sent to Microsoft for > signing in the next couple of weeks. > > Thanks > Dennis Thanks for the update!
note this was an old missing advisory for shim 15.7
SUSE-SU-2024:1368-1: An update that solves seven vulnerabilities, contains one feature and has five security fixes can now be installed. Category: security (important) Bug References: 1198101, 1205588, 1205855, 1210382, 1213945, 1215098, 1215099, 1215100, 1215101, 1215102, 1215103, 1219460 CVE References: CVE-2022-28737, CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551 Jira References: PED-922 Maintenance Incident: [SUSE:Maintenance:32617](https://smelt.suse.de/incident/32617/) Sources used: openSUSE Leap 15.3 (src): shim-15.8-150300.4.20.2, efitools-1.9.2-150300.7.3.1 openSUSE Leap Micro 5.3 (src): shim-15.8-150300.4.20.2 openSUSE Leap Micro 5.4 (src): shim-15.8-150300.4.20.2 openSUSE Leap 15.5 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro for Rancher 5.3 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro 5.3 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro for Rancher 5.4 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro 5.4 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro 5.5 (src): shim-15.8-150300.4.20.2 Basesystem Module 15-SP5 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): shim-15.8-150300.4.20.2 SUSE Manager Proxy 4.3 (src): shim-15.8-150300.4.20.2 SUSE Manager Retail Branch Server 4.3 (src): shim-15.8-150300.4.20.2 SUSE Manager Server 4.3 (src): shim-15.8-150300.4.20.2 SUSE Enterprise Storage 7.1 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro 5.1 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro 5.2 (src): shim-15.8-150300.4.20.2 SUSE Linux Enterprise Micro for Rancher 5.2 (src): shim-15.8-150300.4.20.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1462-1: An update that solves seven vulnerabilities, contains one feature and has five security fixes can now be installed. Category: security (important) Bug References: 1198101, 1205588, 1205855, 1210382, 1213945, 1215098, 1215099, 1215100, 1215101, 1215102, 1215103, 1219460 CVE References: CVE-2022-28737, CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551 Jira References: PED-922 Maintenance Incident: [SUSE:Maintenance:33581](https://smelt.suse.de/incident/33581/) Sources used: SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): shim-15.8-25.30.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): shim-15.8-25.30.1 SUSE Linux Enterprise Server 12 SP5 (src): shim-15.8-25.30.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1461-1: An update that solves seven vulnerabilities, contains one feature and has five security fixes can now be installed. Category: security (important) Bug References: 1198101, 1205588, 1205855, 1210382, 1213945, 1215098, 1215099, 1215100, 1215101, 1215102, 1215103, 1219460 CVE References: CVE-2022-28737, CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551 Jira References: PED-922 Maintenance Incident: [SUSE:Maintenance:33579](https://smelt.suse.de/incident/33579/) Sources used: SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): shim-15.8-150100.3.38.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): shim-15.8-150100.3.38.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): shim-15.8-150100.3.38.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.