openSUSE Security Update: Security update for fwupd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0849-1 Rating: important References: #1172643 Cross-References: CVE-2020-10759 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for fwupd fixes the following issues: - CVE-2020-10759: Fixed a potential PGP signature bypass, which could have led to installation of unsigned firmware (bsc#1172643) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-849=1 Package List: - openSUSE Leap 15.1 (x86_64): dfu-tool-1.0.9-lp151.2.3.1 dfu-tool-debuginfo-1.0.9-lp151.2.3.1 fwupd-1.0.9-lp151.2.3.1 fwupd-debuginfo-1.0.9-lp151.2.3.1 fwupd-debugsource-1.0.9-lp151.2.3.1 fwupd-devel-1.0.9-lp151.2.3.1 libfwupd2-1.0.9-lp151.2.3.1 libfwupd2-debuginfo-1.0.9-lp151.2.3.1 typelib-1_0-Fwupd-2_0-1.0.9-lp151.2.3.1 - openSUSE Leap 15.1 (noarch): fwupd-lang-1.0.9-lp151.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-10759.html https://bugzilla.suse.com/1172643