CVE-2020-10759

MEDIUM Year: 2020
CVSS v3 Score
6.0
Medium
CVSS v2 Score
3.3
Low
Weakness Type
CWE-347
View all →

Vulnerability Description

A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. The highest threat from this vulnerability is to confidentiality and integrity.

Related Vulnerabilities

CVE-2025-20178

MEDIUM
CVSS:6.0(Medium)

A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary command...

CWE-3472025

CVE-2012-2092

MEDIUM
CVSS:5.9(Medium)

A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature.

CWE-3472012

CVE-2017-15090

MEDIUM
CVSS:5.9(Medium)

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data...

CWE-3472017

CVE-2018-0501

MEDIUM
CVSS:5.9(Medium)

The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, a...

CWE-3472018

CVE-2018-12556

MEDIUM
CVSS:5.9(Medium)

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does n...

CWE-3472018

CVE-2018-16149

MEDIUM
CVSS:5.9(Medium)

In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification blindly trusts the declared lengths in the ASN.1 structure. Consequently, when small public exponent...

CWE-3472018