Ubuntu Security Notices
USN-4395-1

USN-4395-1: fwupd vulnerability

Publication date

15 June 2020

Overview

fwupd could be made to install an unsigned firmware.

Releases

20.04 LTS 19.10 18.04 LTS 16.04 LTS

Packages

fwupd - Firmware update daemon

Details

Justin Steven discovered that fwupd incorrectly handled certain signature
verification. An attacker could possibly use this issue to install an unsigned
firmware.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
20.04 focal	fwupd – 1.3.9-4ubuntu0.1
20.04 focal	libfwupd2 – 1.3.9-4ubuntu0.1
19.10 eoan	fwupd – 1.2.10-1ubuntu4.1
19.10 eoan	libfwupd2 – 1.2.10-1ubuntu4.1
18.04 bionic	fwupd – 1.2.10-1ubuntu2~ubuntu18.04.5
18.04 bionic	libfwupd2 – 1.2.10-1ubuntu2~ubuntu18.04.5
16.04 xenial	fwupd – 0.8.3-0ubuntu5.1
16.04 xenial	libfwupd1 – 0.8.3-0ubuntu5.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

CVE-2020-10759

CVE-2020-10759