{"id":"CVE-2019-14560","aliases":["ALSA-2023:6330","ALSA-2023:6919","EUVD-2019-5721","RHSA-2023:6330","RHSA-2023:6919","RHSA-2024:0408","RHSA-2024:1415","SUSE-SU-2023:1921-1","SUSE-SU-2023:1940-1","SUSE-SU-2023:1941-1","SUSE-SU-2023:1958-1","SUSE-SU-2023:1968-1","SUSE-SU-2023:2234-1","UBUNTU-CVE-2019-14560","openSUSE-SU-2024:13451-1"],"status":"rejected","title":"Moderate: edk2 security, bug fix, and enhancement update","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-02-28T19:15:00Z","modified":"2026-10-29T11:31:30Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"edk2-aarch64","fixed_in":["20220126gitbb1bba3d77-6.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"edk2-ovmf","fixed_in":["20220126gitbb1bba3d77-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2","fixed_in":["0:20220126gitbb1bba3d77-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-aarch64","fixed_in":["0:20220126gitbb1bba3d77-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-ovmf","fixed_in":["0:20220126gitbb1bba3d77-6.el8"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ovmf","fixed_in":["202308-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220126gitbb1bba3d77-6.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220126gitbb1bba3d77-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20230524-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-2.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-4.el8_8.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-4.el8_8.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20220126gitbb1bba3d77-4.el8_8.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-150200.7.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-150200.7.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-150200.7.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"201911-150200.7.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-150000.5.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-150000.5.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-150000.5.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.41.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.41.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.41.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.41.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.41.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.41.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2017+git1510945757.b2662641d5-3.41.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202008-150300.10.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015+git1462940744.321151f-19.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202202-150400.5.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-3.1"}]}]}],"references":[{"url":"https://www.suse.com/security/cve/CVE-2019-14560.html"},{"url":"https://security.archlinux.org/CVE-2019-14560"},{"url":"https://access.redhat.com/errata/RHSA-2023:6330","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14560","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-2650","tags":["report"]},{"url":"https://bugzilla.redhat.com/1858038","tags":["report"]},{"url":"https://bugzilla.redhat.com/2207947","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6330.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6919","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-6919.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1858038","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2174749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176920","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186754","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2203094","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2207947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211060","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218196","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6330.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14560","tags":["advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14560","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-2650","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20230530.txt","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2150267","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6919.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0408","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224962","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0408.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3446","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3446","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20230719.txt","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1415","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258697","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1415.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45230","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45230","tags":["advisory"]},{"url":"https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html","tags":["article"]},{"url":"https://github.com/advisories/GHSA-fc9w-pqjw-8r96","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45234","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45234","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45234","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mrjv-p9q7-rxgr","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231921-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174246","tags":["report"]},{"url":"https://bugzilla.suse.com/1196741","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38578","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231940-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231941-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231958-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231968-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232234-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14560","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-14560","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.","status":"rejected","modified":"2023-02-28T00:00:00Z","updated_at":"2026-11-02T14:20:18.085548Z"}],"euvd":[{"id":"EUVD-2019-5721","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.","status":"published","modified":"2023-02-28T00:00:00Z","updated_at":"2026-11-03T03:50:59.876937Z"}],"nvd":[{"id":"CVE-2019-14560","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.","status":"rejected","published":"2023-02-28T19:15:13.407Z","modified":"2023-11-07T03:05:00.51Z","updated_at":"2026-11-02T14:05:49.099942Z"}],"osv":[{"id":"RHSA-2023:6330","title":"Red Hat Security Advisory: edk2 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T11:16:53Z","modified":"2026-10-15T10:05:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:6919","title":"Red Hat Security Advisory: edk2 security and bug fix update","status":"published","published":"2024-09-16T11:17:02Z","modified":"2025-11-22T13:00:17Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2024:0408","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-09-16T11:17:10Z","modified":"2026-10-15T10:06:38Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:1415","title":"Red Hat Security Advisory: edk2 security update","status":"published","published":"2024-09-16T16:51:37Z","modified":"2026-10-15T10:07:24Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"ALSA-2023:6330","title":"Moderate: edk2 security, bug fix, and enhancement update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. \n\nSecurity Fix(es):\n\n* edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() (CVE-2019-14560)\n* openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:30.886467569Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:6919","title":"Moderate: edk2 security and bug fix update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. \n\nSecurity Fix(es):\n\n* edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() (CVE-2019-14560)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:19.322442358Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"openSUSE-SU-2024:13451-1","title":"ovmf-202308-3.1 on GA media","description":"These are all security issues fixed in the ovmf-202308-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:00:11.492626Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:1921-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n  \n- CVE-2019-14560: Fixed potential secure boot bypass via an improper check of GetEfiGlobalVariable2 (bsc#1174246). \n- CVE-2021-38578: Fixed underflow in MdeModulePkg/PiSmmCore SmmEntryPointAdd (bsc#1196741).\n","status":"published","published":"2023-04-19T16:07:13Z","modified":"2026-02-04T04:39:40.249723Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1940-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2019-14560: Fixed potential secure boot bypass via an improper check of GetEfiGlobalVariable2 (bsc#1174246). \n- CVE-2021-38578: Fixed underflow in MdeModulePkg/PiSmmCore SmmEntryPointAdd (bsc#1196741).\n","status":"published","published":"2023-04-21T10:00:34Z","modified":"2026-02-04T04:10:22.717364Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1941-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2019-14560: Fixed potential secure boot bypass via an improper check of GetEfiGlobalVariable2 (bsc#1174246). \n- CVE-2021-38578: Fixed underflow in MdeModulePkg/PiSmmCore SmmEntryPointAdd (bsc#1196741).\n","status":"published","published":"2023-04-21T10:00:48Z","modified":"2026-02-04T04:36:36.330847Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1958-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2019-14560: Fixed potential secure boot bypass via an improper check of GetEfiGlobalVariable2 (bsc#1174246). \n- CVE-2021-38578: Fixed underflow in MdeModulePkg/PiSmmCore SmmEntryPointAdd (bsc#1196741).\n","status":"published","published":"2023-04-24T11:06:00Z","modified":"2026-02-04T04:13:33.840133Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1968-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2019-14560: Fixed potential secure boot bypass via an improper check of GetEfiGlobalVariable2 (bsc#1174246). \n- CVE-2021-38578: Fixed underflow in MdeModulePkg/PiSmmCore SmmEntryPointAdd (bsc#1196741).\n","status":"published","published":"2023-04-24T13:19:22Z","modified":"2025-05-02T04:30:05.611483Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2234-1","title":"Security update for ovmf","description":"This update for ovmf fixes the following issues:\n\n- CVE-2021-38578: Fixed potential underflow in SmmEntryPointwhen computing BufferSize (bsc#1196741).\n- CVE-2019-14560: Fixed potential secure boot bypass caused by improper check of GetEfiGlobalVariable2() return value (bsc#1174246).\n- revert a patch to fix xen boot problems (bsc#1205613)\n","status":"published","published":"2023-05-17T14:22:24Z","modified":"2026-02-04T04:01:02.930015Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"UBUNTU-CVE-2019-14560","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.","status":"withdrawn","published":"2023-02-28T19:15:00Z","modified":"2025-07-08T14:32:19.076351Z","updated_at":"2026-11-02T15:54:19.6877Z"}]}}