Stay Secure with the Latest Linux Advisories

security advisorymoderateupdate

Fedora 34: 2021-cab258a413 Moderate: Shim Bootloader Security Update

- Update to shim 15.4 - Support for revocations via the ".sbat" section and SBAT EFI variable - A new unit test framework and a bunch of unit tests - No external gnu-efi dependency - Better CI Resolves: CVE-2020-14372 Resolves: CVE-2020-25632 Resolves: CVE-2020-25647 Resolves: CVE-2020-27749 Resolves: CVE-2020-27779 Resolves: CVE-2021-20225 Resolves: CVE-2021-20233 - Mark. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-cab258a413 2021-04-23 21:03:15.426820 --------------------------------------------------------------------------------Name : shim Product : Fedora 34 Version : 15.4 Release : 4 URL : https://github.com/rhboot/shim/ Summary : First-stage UEFI bootloader Description : Initial UEFI bootloader that handles chaining to a trusted full bootloader under secure boot environments. This package contains the version signed by the UEFI signing service. --------------------------------------------------------------------------------Update Information: - Update to shim 15.4 - Support for revocations via the ".sbat" section and SBAT EFI variable - A new unit test framework and a bunch of unit tests - No external gnu-efi dependency - Better CI Resolves: CVE-2020-14372 Resolves: CVE-2020-25632 Resolves: CVE-2020-25647 Resolves: CVE-2020-27749 Resolves: CVE-2020-27779 Resolves: CVE-2021-20225 Resolves: CVE-2021-20233 - Mark signed shim packages as protected in dnf. Resolves: rhbz#1874541 - Conflict with older fwupd, but don't require it. Resolves: rhbz#1877751 --------------------------------------------------------------------------------ChangeLog: * Wed Apr 21 2021 Javier Martinez Canillas - 15.4-4 - Fix handling of ignore_db and user_insecure_mode (pjones) - Fix booting on pre-UEFI Macs (pjones) - Fix mok variable storage allocation region (glin) Resolves: rhbz#1948432 - Fix the package version in the .sbat data (pjones) * Tue Apr 62021 Peter Jones - 15.4-3 - Mark signed shim packages as protected in dnf. Resolves: rhbz#1874541 - Conflict with older fwupd, but don't require it. Resolves: rhbz#1877751 * Tue Apr 6 2021 Peter Jones - 15.4-2 - Update to shim 15.4 - Support for revocations via the ".sbat" section and SBAT EFI variable - A new unit test framework and a bunch of unit tests - No external gnu-efi dependency - Better CI Resolves: CVE-2020-14372 Resolves: CVE-2020-25632 Resolves: CVE-2020-25647 Resolves: CVE-2020-27749 Resolves: CVE-2020-27779 Resolves: CVE-2021-20225 Resolves: CVE-2021-20233 --------------------------------------------------------------------------------References: [ 1 ] Bug #1592148 - pxeboot shim crash using newer edk2 firmware https://bugzilla.redhat.com/show_bug.cgi?id=1592148 [ 2 ] Bug #1651016 - kexec/kdump kernel fails to load with EFI secure boot enabled https://bugzilla.redhat.com/show_bug.cgi?id=1651016 [ 3 ] Bug #1874541 - Please mark shim packages as protected packages with DNF https://bugzilla.redhat.com/show_bug.cgi?id=1874541 [ 4 ] Bug #1877751 - fwupd replacing dbxtool.x86_64 8-13.fc33 https://bugzilla.redhat.com/show_bug.cgi?id=1877751 [ 5 ] Bug #1938630 - include new bootloaders on Fedora 34 install media so UEFI Secure Boot enabled systems can boot from them https://bugzilla.redhat.com/show_bug.cgi?id=1938630 [ 6 ] Bug #1948432 - efi: Failed to lookup EFI memory descriptor for 0x000000003a572000 https://bugzilla.redhat.com/show_bug.cgi?id=1948432 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-cab258a413' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys usedby the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure . The recent Shim 15.4 upgrade in Fedora 34 bolsters system security by introducing additional validation protocols and enabling revocation capabilities. Protect your setup now!. Fedora Update, Shim Bootloader, UEFI Support, Security Enhancement. . LinuxSecurity.com Team

Apr 23, 2021 Fedora