{"id":"CVE-2022-28737","aliases":["ALSA-2022:5095","ALSA-2022:5099","AZL-27559","AZL-35252","AZL-40910","AZL-41063","DEBIAN-CVE-2022-28737","EUVD-2022-33176","GHSA-hmxr-46w2-jjwh","OESA-2022-1799","RHSA-2022:5095","RHSA-2022:5096","RHSA-2022:5098","RHSA-2022:5099","RHSA-2022:5100","RLSA-2022:5095","RLSA-2022:5099","SUSE-SU-2023:1702-1","SUSE-SU-2023:1863-1","SUSE-SU-2023:2084-1","SUSE-SU-2023:2086-1","SUSE-SU-2023:2091-1","SUSE-SU-2023:2150-1","SUSE-SU-2024:1368-1","SUSE-SU-2024:1461-1","SUSE-SU-2024:1462-1","UBUNTU-CVE-2022-28737","USN-6355-1"],"status":"published","title":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables","description":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00328,"percentile":0.26311,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2022-06-16T00:00:00Z","modified":"2026-11-03T08:03:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"shim","fixed_in":["15.8-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"shim","fixed_in":["15.8-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"shim-unsigned-aarch64","fixed_in":["15.8-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"shim-unsigned-x64","fixed_in":["15.8-3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"shim","fixed_in":["15.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"shim","fixed_in":["15.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"shim","fixed_in":["15.6-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"shim","fixed_in":["15-22.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"shim","fixed_in":["15-22.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"shim","fixed_in":["15.4-4.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"shim","fixed_in":["15.7-150300.4.11.1","15.7-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"shim","fixed_in":["15.7-25.24.1","15.7-25.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"shim","fixed_in":["15.7-25.24.1","15.7-25.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"shim","fixed_in":["15.7-25.24.1","15.7-25.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"shim","fixed_in":["15.7-25.24.1","15.7-25.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"shim","fixed_in":["15.7-25.24.1","15.7-25.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"shim","fixed_in":["15.7-25.24.1","15.7-25.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"shim","fixed_in":["15.7-25.24.1","15.7-25.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"shim","fixed_in":["15.7-150100.3.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"shim","fixed_in":["15.7-150100.3.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"shim","fixed_in":["15.7-150100.3.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"shim","fixed_in":["15.7-150100.3.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"shim","fixed_in":["15.7-150100.3.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"shim","fixed_in":["15.7-150100.3.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"shim","fixed_in":["15.7-150100.3.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"shim","fixed_in":["15.7-22.15.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"shim","fixed_in":["15.7-0ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"shim","fixed_in":["15.7-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-efi-aa64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-efi-aa64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-efi-aa64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-efi-ia32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-efi-ia32-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-efi-ia32-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-efi-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-efi-x64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-efi-x64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-pc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-pc-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-ppc64le-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-tools-efi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-tools-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grub2-tools-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"shim-aa64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.6-1.el8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"shim-ia32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.6-1.el8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"shim-unsigned-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.6-1.el8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"shim-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.6-1.el8.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-efi-aa64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-efi-aa64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-efi-aa64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-efi-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-efi-x64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-efi-x64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-pc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-pc-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-ppc64le-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-tools-efi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-tools-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"grub2-tools-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"shim-aa64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.6-1.el9.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"shim-unsigned-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.6-1.el9.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"shim-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.6-1.el9.alma"}]}],"bundled":8},{"source":"osv","ecosystem":"Azure Linux:2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"shim-unsigned-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"shim-unsigned-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.6-1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15-22.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15-22.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4-4.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-efi-aa64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-efi-aa64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-efi-aa64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-efi-ia32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-efi-ia32-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-efi-ia32-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-efi-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-efi-x64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-efi-x64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-pc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-pc-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-ppc64le-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-tools-efi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-tools-efi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-tools-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-tools-extra-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-tools-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"grub2-tools-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"shim-aa64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"shim-ia32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"shim-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"shim-unsigned-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-efi-aa64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-efi-aa64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-efi-aa64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-efi-ia32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-efi-ia32-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-efi-ia32-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-efi-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-efi-x64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-efi-x64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-pc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-pc-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-ppc64le-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-tools-efi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-tools-efi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-tools-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-tools-extra-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-tools-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"grub2-tools-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-99.el8_4.9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"shim-aa64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"shim-ia32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"shim-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::crb","package":"shim-unsigned-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-efi-aa64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-efi-ia32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-efi-ia32-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-efi-ia32-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-efi-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-efi-x64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-efi-x64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-pc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-pc-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-ppc64le-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-tools-efi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-tools-efi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-tools-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-tools-extra-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-tools-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"grub2-tools-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_1.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"shim-ia32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::baseos","package":"shim-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-efi-aa64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-efi-aa64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-efi-aa64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-efi-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-efi-x64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-efi-x64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-emu-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-pc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-pc-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-ppc64le-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-tools-efi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-tools-efi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-tools-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-tools-extra-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-tools-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"grub2-tools-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.06-27.el9_0.7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shim-aa64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"shim-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"shim-unsigned-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-efi-aa64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-efi-aa64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-efi-aa64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-efi-ia32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-efi-ia32-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-efi-ia32-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-efi-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-efi-x64-cdboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-efi-x64-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-pc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-pc-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-ppc64le-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-tools-efi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-tools-efi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-tools-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-tools-extra-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-tools-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"grub2-tools-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-87.el8_2.10"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"shim-aa64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"shim-ia32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"shim-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::crb","package":"shim-unsigned-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.02-123.el8_6.8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mokutil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3.0-11.el8_6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"shim-unsigned-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"mokutil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.4.0-8.el9_0.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.6-1.el9.rocky.0.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150100.3.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150100.3.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150100.3.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150100.3.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150100.3.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150100.3.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-150100.3.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-25.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-22.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150300.4.20.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150100.3.38.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150100.3.38.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-150100.3.38.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-25.30.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.8-25.30.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4-0ubuntu4","0.8-0ubuntu2","0.9+1474479173.6c180c6-1ubuntu1","13-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8-0ubuntu2","0.9+1474479173.6c180c6-1ubuntu1","13-0ubuntu2","15+1533136590.3beb971-0ubuntu1","15+1552672080.a4a1fbe-0ubuntu2","15.4-0ubuntu7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9+1474479173.6c180c6-1ubuntu1","13-0ubuntu2","15+1533136590.3beb971-0ubuntu1","15+1552672080.a4a1fbe-0ubuntu2","15.4-0ubuntu7","15.4-0ubuntu9","15.7-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-0ubuntu1"}]}],"versions":["15+1533136590.3beb971-0ubuntu1","15+1552672080.a4a1fbe-0ubuntu1","15+1552672080.a4a1fbe-0ubuntu2","15.4-0ubuntu7","15.4-0ubuntu9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-0ubuntu1"}]}],"versions":["15.4-0ubuntu9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.187.3~20.04.1"}]}],"versions":["1.128","1.129","1.130","1.131","1.133","1.134","1.135","1.136","1.137","1.138","1.139","1.140","1.141","1.142","1.142.1","1.142.3","1.142.4","1.142.5","1.142.6","1.142.8","1.142.9","1.142.10","1.142.11","1.167","1.167.2","1.173.2~20.04.1","1.173.4","1.187.2~20.04.2"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"grub2-unsigned","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.06-2ubuntu14.1"}]}],"versions":["2.04-1ubuntu44","2.04-1ubuntu44.2","2.04-1ubuntu47.4","2.04-1ubuntu47.5","2.06-2ubuntu14"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-0ubuntu1"}]}],"versions":["15+1533136590.3beb971-0ubuntu1","15+1552672080.a4a1fbe-0ubuntu1","15+1552672080.a4a1fbe-0ubuntu2","15.4-0ubuntu7","15.4-0ubuntu9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"shim-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.9"}]}],"versions":["1.39","1.40","1.40.3","1.40.4","1.40.6","1.40.7"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.187.3~22.04.1"}]}],"versions":["1.173","1.174","1.176","1.177","1.178","1.179","1.180","1.182~22.04.1","1.187.2"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"grub2-unsigned","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.06-2ubuntu14.1"}]}],"versions":["2.04-1ubuntu47","2.04-1ubuntu48","2.06-2ubuntu3","2.06-2ubuntu4","2.06-2ubuntu5","2.06-2ubuntu6","2.06-2ubuntu7","2.06-2ubuntu10","2.06-2ubuntu14"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"shim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.7-0ubuntu1"}]}],"versions":["15.4-0ubuntu9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"shim-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.3"}]}],"versions":["1.51"],"bundled":10}],"products":[{"vendor":"red hat bootloader team","product":"shim"},{"vendor":"redhat","product":"shim"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2022/06/07/5","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","report"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28737","tags":["issue-tracking","x_transferred","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28737","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-hmxr-46w2-jjwh"},{"url":"https://access.redhat.com/errata/RHSA-2022:5095","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3695","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3696","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3697","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28733","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28734","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28735","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28736","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28737","tags":["report"]},{"url":"https://bugzilla.redhat.com/1991685","tags":["report"]},{"url":"https://bugzilla.redhat.com/1991686","tags":["report"]},{"url":"https://bugzilla.redhat.com/1991687","tags":["report"]},{"url":"https://bugzilla.redhat.com/2083339","tags":["report"]},{"url":"https://bugzilla.redhat.com/2090463","tags":["report"]},{"url":"https://bugzilla.redhat.com/2090857","tags":["report"]},{"url":"https://bugzilla.redhat.com/2090899","tags":["report"]},{"url":"https://bugzilla.redhat.com/2092613","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-5095.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5099","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-5099.html","tags":["advisory"]},{"url":"https://github.com/rhboot/shim/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28737.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-28737","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1799","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2083339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2090463","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2090857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2090899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2092613","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5095.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3695","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3695","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3696","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3697","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28733","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28733","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28734","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28734","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28735","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28735","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28736","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28737","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5096","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5096.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5098","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5098.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5099.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5100","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5100.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:5095","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:5099","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231702-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185232","tags":["report"]},{"url":"https://bugzilla.suse.com/1185261","tags":["report"]},{"url":"https://bugzilla.suse.com/1185441","tags":["report"]},{"url":"https://bugzilla.suse.com/1185621","tags":["report"]},{"url":"https://bugzilla.suse.com/1187071","tags":["report"]},{"url":"https://bugzilla.suse.com/1187260","tags":["report"]},{"url":"https://bugzilla.suse.com/1193282","tags":["report"]},{"url":"https://bugzilla.suse.com/1198458","tags":["report"]},{"url":"https://bugzilla.suse.com/1201066","tags":["report"]},{"url":"https://bugzilla.suse.com/1202120","tags":["report"]},{"url":"https://bugzilla.suse.com/1205588","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28737","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231863-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193315","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232084-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210382","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232086-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198101","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232091-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232150-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1187696","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241368-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205855","tags":["report"]},{"url":"https://bugzilla.suse.com/1213945","tags":["report"]},{"url":"https://bugzilla.suse.com/1215098","tags":["report"]},{"url":"https://bugzilla.suse.com/1215099","tags":["report"]},{"url":"https://bugzilla.suse.com/1215100","tags":["report"]},{"url":"https://bugzilla.suse.com/1215101","tags":["report"]},{"url":"https://bugzilla.suse.com/1215102","tags":["report"]},{"url":"https://bugzilla.suse.com/1215103","tags":["report"]},{"url":"https://bugzilla.suse.com/1219460","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40551","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241461-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241462-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-28737","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6355-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28733","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28735","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28736","tags":["report"]},{"url":"https://launchpad.net/bugs/2029518","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-28737","title":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables","description":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.","status":"published","published":"2023-07-20T00:26:15.627Z","modified":"2024-10-22T13:17:50.789Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:34:38.922686Z"}],"euvd":[{"id":"EUVD-2022-33176","description":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.","status":"published","published":"2023-07-20T00:26:15Z","modified":"2024-10-22T13:17:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T00:05:22.720016Z"}],"ghsa":[{"id":"GHSA-hmxr-46w2-jjwh","title":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI...","description":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.","status":"published","published":"2023-07-20T03:30:25Z","modified":"2024-04-04T06:17:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:56:40.949889Z"}],"nvd":[{"id":"CVE-2022-28737","description":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.","status":"published","published":"2023-07-20T01:15:10.473Z","modified":"2026-11-10T12:10:00.177Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-10T14:19:22.611066Z"}],"osv":[{"id":"AZL-27559","title":"CVE-2022-28737 affecting package shim for versions less than 15.8-1","description":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.","status":"published","published":"2023-07-20T01:15:10Z","modified":"2026-04-21T04:24:24.705497Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-35252","title":"CVE-2022-28737 affecting package shim for versions less than 15.8-3","description":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.","status":"published","published":"2023-07-20T01:15:10Z","modified":"2026-04-21T04:49:38.123007Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-40910","title":"CVE-2022-28737 affecting package shim-unsigned-aarch64 for versions less than 15.8-3","description":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.","status":"published","published":"2023-07-20T01:15:10Z","modified":"2026-04-21T04:48:26.733048Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-41063","title":"CVE-2022-28737 affecting package shim-unsigned-x64 for versions less than 15.8-3","description":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.","status":"published","published":"2023-07-20T01:15:10Z","modified":"2026-04-21T04:51:30.153905Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"CVE-2022-28737","title":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables","description":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.","status":"published","published":"2023-07-20T00:26:15.627Z","modified":"2026-11-12T02:30:27.589340619Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-12T03:00:03.589223Z"},{"id":"DEBIAN-CVE-2022-28737","description":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.","status":"published","published":"2023-07-20T01:15:10.473Z","modified":"2026-11-11T09:47:39.118109232Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T10:35:40.696585Z"},{"id":"OESA-2022-1799","title":"shim security update","description":"Initial UEFI bootloader that handles chaining to a trusted full bootloader under secure boot environments.\r\n\r\nSecurity Fix(es):\r\n\r\nNo description is available for this CVE.(CVE-2022-28737)","status":"published","published":"2022-08-05T11:05:04Z","modified":"2026-08-18T01:17:17.147072683Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:5095","title":"Red Hat Security Advisory: grub2, mokutil, shim, and shim-unsigned-x64 security update","status":"published","published":"2024-09-16T08:14:17Z","modified":"2026-06-27T10:15:23Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5096","title":"Red Hat Security Advisory: grub2, mokutil, shim, and shim-unsigned-x64 security update","status":"published","published":"2024-09-16T08:14:09Z","modified":"2026-06-27T10:15:24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5098","title":"Red Hat Security Advisory: grub2, mokutil, and shim security update","status":"published","published":"2024-09-16T08:14:02Z","modified":"2026-06-27T10:15:24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5099","title":"Red Hat Security Advisory: grub2, mokutil, shim, and shim-unsigned-x64 security update","status":"published","published":"2024-09-16T08:14:33Z","modified":"2026-06-27T10:15:25Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5100","title":"Red Hat Security Advisory: grub2, mokutil, shim, and shim-unsigned-x64 security update","status":"published","published":"2024-09-16T08:14:25Z","modified":"2026-06-27T10:15:26Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:5095","title":"Important: grub2, mokutil, shim, and shim-unsigned-x64 security update","description":"The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.\n\nThe shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)\n\n* grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)\n\n* grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)\n\n* grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)\n\n* grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)\n\n* grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)\n\n* grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)\n\n* shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-06-16T13:10:10Z","modified":"2026-02-04T12:30:06.529922Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:5099","title":"Important: grub2, mokutil, shim, and shim-unsigned-x64 security update","description":"The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.\n\nThe shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\n\nSecurity Fix(es):\n\n* grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)\n\n* grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)\n\n* grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)\n\n* grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)\n\n* grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)\n\n* grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)\n\n* grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)\n\n* shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-06-16T13:17:13Z","modified":"2026-02-05T02:30:09.845929Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-28737","description":"There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.","status":"published","published":"2023-07-20T01:15:00Z","modified":"2026-02-04T02:22:05.305527Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"ALSA-2022:5095","title":"Important: grub2, mokutil, shim, and shim-unsigned-x64 security update","description":"The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.\nThe shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\nSecurity Fix(es):\n* grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)\n* grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)\n* grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)\n* grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)\n* grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)\n* grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)\n* grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)\n* shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-06-16T00:00:00Z","modified":"2026-10-29T11:01:05.280203919Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2022:5099","title":"Important: grub2, mokutil, shim, and shim-unsigned-x64 security update","description":"The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.\nThe shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments.\nSecurity Fix(es):\n* grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)\n* grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695)\n* grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696)\n* grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697)\n* grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734)\n* grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735)\n* grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736)\n* shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-06-16T00:00:00Z","modified":"2026-10-29T11:31:10.985361647Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"SUSE-SU-2023:1702-1","title":"Security update for shim","description":"This update for shim fixes the following issues:\n\n- Updated shim signature after shim 15.7 be signed back:\n  signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458)\n\n- Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to\n  disable the NX compatibility flag when using post-process-pe because\n  grub2 is not ready. (bsc#1205588)\n\n- Enable the NX compatibility flag by default. (jsc#PED-127) \n\nUpdate to 15.7 (bsc#1198458) (jsc#PED-127):\n\n- Make SBAT variable payload introspectable\n- Reference MokListRT instead of MokList\n- Add a link to the test plan in the readme.\n- [V3] Enable TDX measurement to RTMR register\n- Discard load-options that start with a NUL\n- Fixed load_cert_file bugs\n- Add -malign-double to IA32 compiler flags\n- pe: Fix image section entry-point validation\n- make-archive: Build reproducible tarball\n- mok: remove MokListTrusted from PCR 7\n\nOther fixes:\n\n- Support enhance shim measurement to TD RTMR. (jsc#PED-1273) \n\n- shim-install: ensure grub.cfg created is not overwritten after installing grub related files\n- Add logic to shim.spec to only set sbat policy when efivarfs is writeable.  (bsc#1201066)\n- Add logic to shim.spec for detecting --set-sbat-policy option before using mokutil to set sbat policy. (bsc#1202120)\n- Change the URL in SBAT section to mail:security@suse.de. (bsc#1193282)\n\nUpdate to 15.6 (bsc#1198458):\n\n- MokManager: removed Locate graphic output protocol fail error message\n- shim: implement SBAT verification for the shim_lock protocol\n- post-process-pe: Fix a missing return code check\n- Update github actions matrix to be more useful\n- post-process-pe: Fix format string warnings on 32-bit platforms\n- Allow MokListTrusted to be enabled by default\n- Re-add ARM AArch64 support\n- Use ASCII as fallback if Unicode Box Drawing characters fail\n- make: don't treat cert.S specially\n- shim: use SHIM_DEVEL_VERBOSE when built in devel mode\n- Break out of the inner sbat loop if we find the entry.\n- Support loading additional certificates\n- Add support for NX (W^X) mitigations.\n- Fix preserve_sbat_uefi_variable() logic\n- SBAT Policy latest should be a one-shot\n- pe: Fix a buffer overflow when SizeOfRawData \u003e VirtualSize\n- pe: Perform image verification earlier when loading grub\n- Update advertised sbat generation number for shim\n- Update SBAT generation requirements for 05/24/22\n- Also avoid CVE-2022-28737 in verify_image() by @vathpela\n\nUpdate to 15.5 (bsc#1198458):\n\n- Broken ia32 relocs and an unimportant submodule change.\n- mok: allocate MOK config table as BootServicesData\n- Don't call QueryVariableInfo() on EFI 1.10 machines (bsc#1187260)\n- Relax the check for import_mok_state()  (bsc#1185261)\n- SBAT.md: trivial changes\n- shim: another attempt to fix load options handling\n- Add tests for our load options parsing.\n- arm/aa64: fix the size of .rela* sections\n- mok: fix potential buffer overrun in import_mok_state\n- mok: relax the maximum variable size check\n- Don't unhook ExitBootServices when EBS protection is disabled\n- fallback: find_boot_option() needs to return the index for the boot entry in optnum\n- httpboot: Ignore case when checking HTTP headers\n- Fallback allocation errors\n- shim: avoid BOOTx64.EFI in message on other architectures\n- str: remove duplicate parameter check\n- fallback: add compile option FALLBACK_NONINTERACTIVE\n- Test mok mirror\n- Modify sbat.md to help with readability.\n- csv: detect end of csv file correctly\n- Specify that the .sbat section is ASCII not UTF-8\n- tests: add 'include-fixed' GCC directory to include directories\n- pe: simplify generate_hash()\n- Don't make shim abort when TPM log event fails (RHBZ #2002265)\n- Fallback to default loader if parsed one does not exist\n- fallback: Fix for BootOrder crash when index returned\n- Better console checks\n- docs: update SBAT UEFI variable name\n- Don't parse load options if invoked from removable media path\n- fallback: fix fallback not passing arguments of the first boot option\n- shim: Don't stop forever at 'Secure Boot not enabled' notification\n- Allocate mokvar table in runtime memory.\n- Remove post-process-pe on 'make clean'\n- pe: missing perror argument\n\n\n- CVE-2022-28737: Fixed a buffer overflow when SizeOfRawData \u003e VirtualSize (bsc#1198458)\n\n- Add mokutil command to post script for setting sbat policy to latest mode\n  when the SbatPolicy-605dab50-e046-4300-abb6-3dd810dd8b23 is not created.\n  (bsc#1198458)\n\n- Updated vendor dbx binary and script (bsc#1198458)\n\n  - Updated dbx-cert.tar.xz and vendor-dbx-sles.bin for adding\n    SLES-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.\n  - Updated dbx-cert.tar.xz and vendor-dbx-opensuse.bin for adding\n    openSUSE-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.\n  - Updated vendor-dbx.bin for adding SLES-UEFI-SIGN-Certificate-2021-05.crt\n    and openSUSE-UEFI-SIGN-Certificate-2021-05.crt for testing environment.\n  - Updated generate-vendor-dbx.sh script for generating a vendor-dbx.bin\n    file which includes all .der for testing environment.\n\n- avoid buffer overflow when copying data to the MOK config table (bsc#1185232)\n- Disable exporting vendor-dbx to MokListXRT since writing a large RT variable could crash some machines (bsc#1185261)\n- ignore the odd LoadOptions length (bsc#1185232)\n- shim-install: reset def_shim_efi to 'shim.efi' if the given file doesn't exist\n- relax the maximum variable size check for u-boot (bsc#1185621)\n- handle ignore_db and user_insecure_mode correctly (bsc#1185441, bsc#1187071)\n\n- Split the keys in vendor-dbx.bin to vendor-dbx-sles and\n  vendor-dbx-opensuse for shim-sles and shim-opensuse to reduce\n  the size of MokListXRT (bsc#1185261) \n  + Also update generate-vendor-dbx.sh in dbx-cert.tar.xz\n","status":"published","published":"2023-03-30T13:23:29Z","modified":"2026-02-04T03:43:24.151367Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1863-1","title":"Security update for shim","description":"This update for shim fixes the following issues:\n\n- Updated shim signature after shim 15.7 be signed back:\n  signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458)\n\n- Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to\n  disable the NX compatibility flag when using post-process-pe because\n  grub2 is not ready. (bsc#1205588)\n\n- Enable the NX compatibility flag by default. (jsc#PED-127) \n\nUpdate to 15.7 (bsc#1198458) (jsc#PED-127):\n\n- Make SBAT variable payload introspectable\n- Reference MokListRT instead of MokList\n- Add a link to the test plan in the readme.\n- [V3] Enable TDX measurement to RTMR register\n- Discard load-options that start with a NUL\n- Fixed load_cert_file bugs\n- Add -malign-double to IA32 compiler flags\n- pe: Fix image section entry-point validation\n- make-archive: Build reproducible tarball\n- mok: remove MokListTrusted from PCR 7\n\nOther fixes:\n\n- Support enhance shim measurement to TD RTMR. (jsc#PED-1273) \n\n- shim-install: ensure grub.cfg created is not overwritten after installing grub related files\n- Add logic to shim.spec to only set sbat policy when efivarfs is writeable.  (bsc#1201066)\n- Add logic to shim.spec for detecting --set-sbat-policy option before using mokutil to set sbat policy. (bsc#1202120)\n- Change the URL in SBAT section to mail:security@suse.de. (bsc#1193282)\n\nUpdate to 15.6 (bsc#1198458):\n\n- MokManager: removed Locate graphic output protocol fail error message\n- shim: implement SBAT verification for the shim_lock protocol\n- post-process-pe: Fix a missing return code check\n- Update github actions matrix to be more useful\n- post-process-pe: Fix format string warnings on 32-bit platforms\n- Allow MokListTrusted to be enabled by default\n- Re-add ARM AArch64 support\n- Use ASCII as fallback if Unicode Box Drawing characters fail\n- make: don't treat cert.S specially\n- shim: use SHIM_DEVEL_VERBOSE when built in devel mode\n- Break out of the inner sbat loop if we find the entry.\n- Support loading additional certificates\n- Add support for NX (W^X) mitigations.\n- Fix preserve_sbat_uefi_variable() logic\n- SBAT Policy latest should be a one-shot\n- pe: Fix a buffer overflow when SizeOfRawData \u003e VirtualSize\n- pe: Perform image verification earlier when loading grub\n- Update advertised sbat generation number for shim\n- Update SBAT generation requirements for 05/24/22\n- Also avoid CVE-2022-28737 in verify_image() by @vathpela\n\nUpdate to 15.5 (bsc#1198458):\n\n- Broken ia32 relocs and an unimportant submodule change.\n- mok: allocate MOK config table as BootServicesData\n- Don't call QueryVariableInfo() on EFI 1.10 machines (bsc#1187260)\n- Relax the check for import_mok_state()  (bsc#1185261)\n- SBAT.md: trivial changes\n- shim: another attempt to fix load options handling\n- Add tests for our load options parsing.\n- arm/aa64: fix the size of .rela* sections\n- mok: fix potential buffer overrun in import_mok_state\n- mok: relax the maximum variable size check\n- Don't unhook ExitBootServices when EBS protection is disabled\n- fallback: find_boot_option() needs to return the index for the boot entry in optnum\n- httpboot: Ignore case when checking HTTP headers\n- Fallback allocation errors\n- shim: avoid BOOTx64.EFI in message on other architectures\n- str: remove duplicate parameter check\n- fallback: add compile option FALLBACK_NONINTERACTIVE\n- Test mok mirror\n- Modify sbat.md to help with readability.\n- csv: detect end of csv file correctly\n- Specify that the .sbat section is ASCII not UTF-8\n- tests: add 'include-fixed' GCC directory to include directories\n- pe: simplify generate_hash()\n- Don't make shim abort when TPM log event fails (RHBZ #2002265)\n- Fallback to default loader if parsed one does not exist\n- fallback: Fix for BootOrder crash when index returned\n- Better console checks\n- docs: update SBAT UEFI variable name\n- Don't parse load options if invoked from removable media path\n- fallback: fix fallback not passing arguments of the first boot option\n- shim: Don't stop forever at 'Secure Boot not enabled' notification\n- Allocate mokvar table in runtime memory.\n- Remove post-process-pe on 'make clean'\n- pe: missing perror argument\n\n\n- CVE-2022-28737: Fixed a buffer overflow when SizeOfRawData \u003e VirtualSize (bsc#1198458)\n\n- Add mokutil command to post script for setting sbat policy to latest mode\n  when the SbatPolicy-605dab50-e046-4300-abb6-3dd810dd8b23 is not created.\n  (bsc#1198458)\n\n- Updated vendor dbx binary and script (bsc#1198458)\n\n  - Updated dbx-cert.tar.xz and vendor-dbx-sles.bin for adding\n    SLES-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.\n  - Updated dbx-cert.tar.xz and vendor-dbx-opensuse.bin for adding\n    openSUSE-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.\n  - Updated vendor-dbx.bin for adding SLES-UEFI-SIGN-Certificate-2021-05.crt\n    and openSUSE-UEFI-SIGN-Certificate-2021-05.crt for testing environment.\n  - Updated generate-vendor-dbx.sh script for generating a vendor-dbx.bin\n    file which includes all .der for testing environment.\n\n- avoid buffer overflow when copying data to the MOK config table (bsc#1185232)\n- Disable exporting vendor-dbx to MokListXRT since writing a large RT variable could crash some machines (bsc#1185261)\n- ignore the odd LoadOptions length (bsc#1185232)\n- shim-install: reset def_shim_efi to 'shim.efi' if the given file doesn't exist\n- relax the maximum variable size check for u-boot (bsc#1185621)\n- handle ignore_db and user_insecure_mode correctly (bsc#1185441, bsc#1187071)\n\n- Split the keys in vendor-dbx.bin to vendor-dbx-sles and\n  vendor-dbx-opensuse for shim-sles and shim-opensuse to reduce\n  the size of MokListXRT (bsc#1185261) \n  + Also update generate-vendor-dbx.sh in dbx-cert.tar.xz\n","status":"published","published":"2023-04-17T07:34:56Z","modified":"2026-02-04T03:37:41.580095Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2084-1","title":"Security update for shim","description":"This update for shim fixes the following issues:\n\n- CVE-2022-28737 was missing as reference previously.\n\n- Upgrade shim-install for bsc#1210382\n\n  After closing Leap-gap project since Leap 15.3, openSUSE Leap direct\n  uses shim from SLE. So the ca_string is 'SUSE Linux Enterprise Secure Boot\n  CA1', not 'openSUSE Secure Boot CA1'. It causes that the update_boot=no,\n  so all files in /boot/efi/EFI/boot are not updated.\n\n  Logic was added that is using ID field in os-release for\n  checking Leap distro and set ca_string to 'SUSE Linux Enterprise Secure\n  Boot CA1'. Then /boot/efi/EFI/boot/* can also be updated.\n","status":"published","published":"2023-05-02T11:32:01Z","modified":"2026-02-04T03:17:49.623125Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2086-1","title":"Security update for shim","description":"This update for shim fixes the following issues:\n\n- Updated shim signature after shim 15.7 be signed back:\n  signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458)\n\n- Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to\n  disable the NX compatibility flag when using post-process-pe because\n  grub2 is not ready. (bsc#1205588)\n\n- Enable the NX compatibility flag by default. (jsc#PED-127) \n\nUpdate to 15.7 (bsc#1198458) (jsc#PED-127):\n\n- Make SBAT variable payload introspectable\n- Reference MokListRT instead of MokList\n- Add a link to the test plan in the readme.\n- [V3] Enable TDX measurement to RTMR register\n- Discard load-options that start with a NUL\n- Fixed load_cert_file bugs\n- Add -malign-double to IA32 compiler flags\n- pe: Fix image section entry-point validation\n- make-archive: Build reproducible tarball\n- mok: remove MokListTrusted from PCR 7\n\nOther fixes:\n\n- Support enhance shim measurement to TD RTMR. (jsc#PED-1273) \n\n- shim-install: ensure grub.cfg created is not overwritten after installing grub related files\n- Add logic to shim.spec to only set sbat policy when efivarfs is writeable.  (bsc#1201066)\n- Add logic to shim.spec for detecting --set-sbat-policy option before using mokutil to set sbat policy. (bsc#1202120)\n- Change the URL in SBAT section to mail:security@suse.de. (bsc#1193282)\n\nUpdate to 15.6 (bsc#1198458):\n\n- MokManager: removed Locate graphic output protocol fail error message\n- shim: implement SBAT verification for the shim_lock protocol\n- post-process-pe: Fix a missing return code check\n- Update github actions matrix to be more useful\n- post-process-pe: Fix format string warnings on 32-bit platforms\n- Allow MokListTrusted to be enabled by default\n- Re-add ARM AArch64 support\n- Use ASCII as fallback if Unicode Box Drawing characters fail\n- make: don't treat cert.S specially\n- shim: use SHIM_DEVEL_VERBOSE when built in devel mode\n- Break out of the inner sbat loop if we find the entry.\n- Support loading additional certificates\n- Add support for NX (W^X) mitigations.\n- Fix preserve_sbat_uefi_variable() logic\n- SBAT Policy latest should be a one-shot\n- pe: Fix a buffer overflow when SizeOfRawData \u003e VirtualSize\n- pe: Perform image verification earlier when loading grub\n- Update advertised sbat generation number for shim\n- Update SBAT generation requirements for 05/24/22\n- Also avoid CVE-2022-28737 in verify_image() by @vathpela\n\nUpdate to 15.5 (bsc#1198458):\n\n- Broken ia32 relocs and an unimportant submodule change.\n- mok: allocate MOK config table as BootServicesData\n- Don't call QueryVariableInfo() on EFI 1.10 machines (bsc#1187260)\n- Relax the check for import_mok_state()  (bsc#1185261)\n- SBAT.md: trivial changes\n- shim: another attempt to fix load options handling\n- Add tests for our load options parsing.\n- arm/aa64: fix the size of .rela* sections\n- mok: fix potential buffer overrun in import_mok_state\n- mok: relax the maximum variable size check\n- Don't unhook ExitBootServices when EBS protection is disabled\n- fallback: find_boot_option() needs to return the index for the boot entry in optnum\n- httpboot: Ignore case when checking HTTP headers\n- Fallback allocation errors\n- shim: avoid BOOTx64.EFI in message on other architectures\n- str: remove duplicate parameter check\n- fallback: add compile option FALLBACK_NONINTERACTIVE\n- Test mok mirror\n- Modify sbat.md to help with readability.\n- csv: detect end of csv file correctly\n- Specify that the .sbat section is ASCII not UTF-8\n- tests: add 'include-fixed' GCC directory to include directories\n- pe: simplify generate_hash()\n- Don't make shim abort when TPM log event fails (RHBZ #2002265)\n- Fallback to default loader if parsed one does not exist\n- fallback: Fix for BootOrder crash when index returned\n- Better console checks\n- docs: update SBAT UEFI variable name\n- Don't parse load options if invoked from removable media path\n- fallback: fix fallback not passing arguments of the first boot option\n- shim: Don't stop forever at 'Secure Boot not enabled' notification\n- Allocate mokvar table in runtime memory.\n- Remove post-process-pe on 'make clean'\n- pe: missing perror argument\n\n\n- CVE-2022-28737: Fixed a buffer overflow when SizeOfRawData \u003e VirtualSize (bsc#1198458)\n\n- Add mokutil command to post script for setting sbat policy to latest mode\n  when the SbatPolicy-605dab50-e046-4300-abb6-3dd810dd8b23 is not created.\n  (bsc#1198458)\n\n- Updated vendor dbx binary and script (bsc#1198458)\n\n  - Updated dbx-cert.tar.xz and vendor-dbx-sles.bin for adding\n    SLES-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.\n  - Updated dbx-cert.tar.xz and vendor-dbx-opensuse.bin for adding\n    openSUSE-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.\n  - Updated vendor-dbx.bin for adding SLES-UEFI-SIGN-Certificate-2021-05.crt\n    and openSUSE-UEFI-SIGN-Certificate-2021-05.crt for testing environment.\n  - Updated generate-vendor-dbx.sh script for generating a vendor-dbx.bin\n    file which includes all .der for testing environment.\n\n- avoid buffer overflow when copying data to the MOK config table (bsc#1185232)\n- Disable exporting vendor-dbx to MokListXRT since writing a large RT variable could crash some machines (bsc#1185261)\n- ignore the odd LoadOptions length (bsc#1185232)\n- shim-install: reset def_shim_efi to 'shim.efi' if the given file doesn't exist\n- relax the maximum variable size check for u-boot (bsc#1185621)\n- handle ignore_db and user_insecure_mode correctly (bsc#1185441, bsc#1187071)\n\n- Split the keys in vendor-dbx.bin to vendor-dbx-sles and\n  vendor-dbx-opensuse for shim-sles and shim-opensuse to reduce\n  the size of MokListXRT (bsc#1185261) \n  + Also update generate-vendor-dbx.sh in dbx-cert.tar.xz\n","status":"published","published":"2023-05-02T13:19:02Z","modified":"2025-05-02T04:33:04.102051Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2091-1","title":"Security update for shim","description":"This update for shim fixes the following issues:\n\n- Update only adds the CVE reference to the previously released update (bsc#1198458, CVE-2022-28737)\n","status":"published","published":"2023-05-03T08:34:53Z","modified":"2026-02-04T04:31:55.808395Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2150-1","title":"Security update for shim","description":"This update for shim fixes the following issues:\n\n- Updated shim signature after shim 15.7 be signed back:\n  signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458)\n\n- Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to\n  disable the NX compatibility flag when using post-process-pe because\n  grub2 is not ready. (bsc#1205588)\n\n- Enable the NX compatibility flag by default. (jsc#PED-127) \n\nUpdate to 15.7 (bsc#1198458) (jsc#PED-127):\n\n- Make SBAT variable payload introspectable\n- Reference MokListRT instead of MokList\n- Add a link to the test plan in the readme.\n- [V3] Enable TDX measurement to RTMR register\n- Discard load-options that start with a NUL\n- Fixed load_cert_file bugs\n- Add -malign-double to IA32 compiler flags\n- pe: Fix image section entry-point validation\n- make-archive: Build reproducible tarball\n- mok: remove MokListTrusted from PCR 7\n\nOther fixes:\n\n- Support enhance shim measurement to TD RTMR. (jsc#PED-1273) \n\n- shim-install: ensure grub.cfg created is not overwritten after installing grub related files\n- Add logic to shim.spec to only set sbat policy when efivarfs is writeable.  (bsc#1201066)\n- Add logic to shim.spec for detecting --set-sbat-policy option before using mokutil to set sbat policy. (bsc#1202120)\n- Change the URL in SBAT section to mail:security@suse.de. (bsc#1193282)\n\nUpdate to 15.6 (bsc#1198458):\n\n- MokManager: removed Locate graphic output protocol fail error message\n- shim: implement SBAT verification for the shim_lock protocol\n- post-process-pe: Fix a missing return code check\n- Update github actions matrix to be more useful\n- post-process-pe: Fix format string warnings on 32-bit platforms\n- Allow MokListTrusted to be enabled by default\n- Re-add ARM AArch64 support\n- Use ASCII as fallback if Unicode Box Drawing characters fail\n- make: don't treat cert.S specially\n- shim: use SHIM_DEVEL_VERBOSE when built in devel mode\n- Break out of the inner sbat loop if we find the entry.\n- Support loading additional certificates\n- Add support for NX (W^X) mitigations.\n- Fix preserve_sbat_uefi_variable() logic\n- SBAT Policy latest should be a one-shot\n- pe: Fix a buffer overflow when SizeOfRawData \u003e VirtualSize\n- pe: Perform image verification earlier when loading grub\n- Update advertised sbat generation number for shim\n- Update SBAT generation requirements for 05/24/22\n- Also avoid CVE-2022-28737 in verify_image() by @vathpela\n\nUpdate to 15.5 (bsc#1198458):\n\n- Broken ia32 relocs and an unimportant submodule change.\n- mok: allocate MOK config table as BootServicesData\n- Don't call QueryVariableInfo() on EFI 1.10 machines (bsc#1187260)\n- Relax the check for import_mok_state()  (bsc#1185261)\n- SBAT.md: trivial changes\n- shim: another attempt to fix load options handling\n- Add tests for our load options parsing.\n- arm/aa64: fix the size of .rela* sections\n- mok: fix potential buffer overrun in import_mok_state\n- mok: relax the maximum variable size check\n- Don't unhook ExitBootServices when EBS protection is disabled\n- fallback: find_boot_option() needs to return the index for the boot entry in optnum\n- httpboot: Ignore case when checking HTTP headers\n- Fallback allocation errors\n- shim: avoid BOOTx64.EFI in message on other architectures\n- str: remove duplicate parameter check\n- fallback: add compile option FALLBACK_NONINTERACTIVE\n- Test mok mirror\n- Modify sbat.md to help with readability.\n- csv: detect end of csv file correctly\n- Specify that the .sbat section is ASCII not UTF-8\n- tests: add 'include-fixed' GCC directory to include directories\n- pe: simplify generate_hash()\n- Don't make shim abort when TPM log event fails (RHBZ #2002265)\n- Fallback to default loader if parsed one does not exist\n- fallback: Fix for BootOrder crash when index returned\n- Better console checks\n- docs: update SBAT UEFI variable name\n- Don't parse load options if invoked from removable media path\n- fallback: fix fallback not passing arguments of the first boot option\n- shim: Don't stop forever at 'Secure Boot not enabled' notification\n- Allocate mokvar table in runtime memory.\n- Remove post-process-pe on 'make clean'\n- pe: missing perror argument\n\n\n- CVE-2022-28737: Fixed a buffer overflow when SizeOfRawData \u003e VirtualSize (bsc#1198458)\n\n- Add mokutil command to post script for setting sbat policy to latest mode\n  when the SbatPolicy-605dab50-e046-4300-abb6-3dd810dd8b23 is not created.\n  (bsc#1198458)\n\n- Updated vendor dbx binary and script (bsc#1198458)\n\n  - Updated dbx-cert.tar.xz and vendor-dbx-sles.bin for adding\n    SLES-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.\n  - Updated dbx-cert.tar.xz and vendor-dbx-opensuse.bin for adding\n    openSUSE-UEFI-SIGN-Certificate-2021-05.crt to vendor dbx list.\n  - Updated vendor-dbx.bin for adding SLES-UEFI-SIGN-Certificate-2021-05.crt\n    and openSUSE-UEFI-SIGN-Certificate-2021-05.crt for testing environment.\n  - Updated generate-vendor-dbx.sh script for generating a vendor-dbx.bin\n    file which includes all .der for testing environment.\n\n- avoid buffer overflow when copying data to the MOK config table (bsc#1185232)\n- Disable exporting vendor-dbx to MokListXRT since writing a large RT variable could crash some machines (bsc#1185261)\n- ignore the odd LoadOptions length (bsc#1185232)\n- shim-install: reset def_shim_efi to 'shim.efi' if the given file doesn't exist\n- relax the maximum variable size check for u-boot (bsc#1185621)\n- handle ignore_db and user_insecure_mode correctly (bsc#1185441, bsc#1187071)\n\n- Split the keys in vendor-dbx.bin to vendor-dbx-sles and\n  vendor-dbx-opensuse for shim-sles and shim-opensuse to reduce\n  the size of MokListXRT (bsc#1185261) \n  + Also update generate-vendor-dbx.sh in dbx-cert.tar.xz\n\nUpdate shim to 15.4-4.7.1, Version: 15.4, 'Thu Jul 15 2021'\n\n- Update the SLE signatures\n- Includes fixes for MOK and boot problems (bsc#1187696, bsc#1185261, bsc#1185441,\n  bsc#1187071, bsc#1185621, bsc#1185261, bsc#1185232, bsc#1185261,\n  bsc#1187260, bsc#1185232)\n\n","status":"published","published":"2023-05-09T15:34:27Z","modified":"2026-02-04T03:21:17.112689Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2024:1368-1","title":"Security update for shim","description":"This update for shim fixes the following issues:\n\n- Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)\n- Limit the requirement of fde-tpm-helper-macros to the distro with\n  suse_version 1600 and above (bsc#1219460)\n\nUpdate to version 15.8:\n\nSecurity issues fixed:\n\n- mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)\n- avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)\n- Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)\n- Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)\n- pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)\n- pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)\n\n        \nThe NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.\n\n- Generate dbx during build so we don't include binary files in sources\n- Don't require grub so shim can still be used with systemd-boot\n- Update shim-install to fix boot failure of ext4 root file system\n  on RAID10 (bsc#1205855)\n- Adopt the macros from fde-tpm-helper-macros to update the\n  signature in the sealed key after a bootloader upgrade\n\n- Update shim-install to amend full disk encryption support\n  - Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector\n  - Use the long name to specify the grub2 key protector\n  - cryptodisk: support TPM authorized policies\n  - Do not use tpm_record_pcrs unless the command is in command.lst\n\n- Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to\n  enable the NX compatibility flag when using post-process-pe after\n  discussed with grub2 experts in mail. It's useful for further development\n  and testing. (bsc#1205588)\n","status":"published","published":"2024-04-22T09:06:33Z","modified":"2025-05-02T04:33:04.283397Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1461-1","title":"Security update for shim","description":"This update for shim fixes the following issues:\n\n- Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)\n- Limit the requirement of fde-tpm-helper-macros to the distro with\n  suse_version 1600 and above (bsc#1219460)\n\nUpdate to version 15.8:\n\nSecurity issues fixed:\n\n- mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)\n- avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)\n- Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)\n- Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)\n- pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)\n- pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)\n\n        \nThe NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.\n\n- Generate dbx during build so we don't include binary files in sources\n- Don't require grub so shim can still be used with systemd-boot\n- Update shim-install to fix boot failure of ext4 root file system\n  on RAID10 (bsc#1205855)\n- Adopt the macros from fde-tpm-helper-macros to update the\n  signature in the sealed key after a bootloader upgrade\n\n- Update shim-install to amend full disk encryption support\n  - Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector\n  - Use the long name to specify the grub2 key protector\n  - cryptodisk: support TPM authorized policies\n  - Do not use tpm_record_pcrs unless the command is in command.lst\n\n- Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to\n  enable the NX compatibility flag when using post-process-pe after\n  discussed with grub2 experts in mail. It's useful for further development\n  and testing. (bsc#1205588)\n","status":"published","published":"2024-04-29T11:19:11Z","modified":"2026-02-04T03:43:29.240556Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1462-1","title":"Security update for shim","description":"This update for shim fixes the following issues:\n\n- Update shim-install to set the TPM2 SRK algorithm (bsc#1213945)\n- Limit the requirement of fde-tpm-helper-macros to the distro with\n  suse_version 1600 and above (bsc#1219460)\n\nUpdate to version 15.8:\n\nSecurity issues fixed:\n\n- mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)\n- avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)\n- Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)\n- Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)\n- pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)\n- pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)\n\n        \nThe NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now.\n\n- Generate dbx during build so we don't include binary files in sources\n- Don't require grub so shim can still be used with systemd-boot\n- Update shim-install to fix boot failure of ext4 root file system\n  on RAID10 (bsc#1205855)\n- Adopt the macros from fde-tpm-helper-macros to update the\n  signature in the sealed key after a bootloader upgrade\n\n- Update shim-install to amend full disk encryption support\n  - Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector\n  - Use the long name to specify the grub2 key protector\n  - cryptodisk: support TPM authorized policies\n  - Do not use tpm_record_pcrs unless the command is in command.lst\n\n- Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to\n  enable the NX compatibility flag when using post-process-pe after\n  discussed with grub2 experts in mail. It's useful for further development\n  and testing. (bsc#1205588)\n","status":"published","published":"2024-04-29T11:20:38Z","modified":"2026-02-04T04:38:27.319975Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-6355-1","title":"grub2-signed, grub2-unsigned, shim, and shim-signed vulnerability","description":"Daniel Axtens discovered that specially crafted images could cause a\nheap-based out-of-bonds write. A local attacker could possibly use\nthis to circumvent secure boot protections. (CVE-2021-3695)\n\nDaniel Axtens discovered that specially crafted images could cause\nout-of-bonds read and write. A local attacker could possibly use this\nto circumvent secure boot protections. (CVE-2021-3696)\n\nDaniel Axtens discovered that specially crafted images could cause\nbuffer underwrite which allows arbitrary data to be written to a heap.\nA local attacker could possibly use this to circumvent secure\nboot protections. (CVE-2021-3697)\n\nIt was discovered that GRUB2 configuration files were created with\nthe wrong permissions. An attacker could possibly use this to leak\nencrypted passwords. (CVE-2021-3981)\n\nDaniel Axtens discovered that specially crafted IP packets could cause\nan integer underflow and write past the end of a buffer. An attacker\ncould possibly use this to circumvent secure boot protections.\n(CVE-2022-28733)\n\nDaniel Axtens discovered that specially crafted HTTP headers can cause\nan out-of-bounds write of a NULL byte. An attacker could possibly use\nthis to corrupt GRUB2's internal data. (CVE-2022-28734)\n\nJulian Andres Klode discovered that GRUB2 shim_lock allowed non-\nkernel files to be loaded. A local attack could possibly use this to\ncircumvent secure boot protections. (CVE-2022-28735)\n\nChris Coulson discovered that executing chainloaders more than once\ncaused a use-after-free vulnerability. A local attack could possibly\nuse this to circumvent secure boot protections. (CVE-2022-28736)\n\nChris Coulson discovered that specially crafted executables could\ncause shim to make out-of-bound writes. A local attack could possibly\nuse this to circumvent secure boot protections. (CVE-2022-28737)\n\nZhang Boyang discovered that specially crafted unicode sequences\ncould lead to an out-of-bounds write to a heap. A local attacker could\npossibly use this to circumvent secure boot protections.\n(CVE-2022-3775)\n","status":"published","published":"2023-09-08T21:56:31Z","modified":"2026-05-29T18:00:45.326898665Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}