Does openssl CVE affect shim?

rhboot / shim

UEFI shim loader

Other

819 stars 289 forks source link

Closed 15058718379 closed 11 months ago

15058718379 commented 1 year ago

We found that the openssl code involves these CVEs. Does this affect the functionality of the shim? CVE-2023-0464 CVE-2023-0465 CVE-2023-0466

vathpela commented 11 months ago

CVE-2023-0464 - if you can DoS shim with a malicious certificate in the signing chain, then you can DoS the system by removing the bootloader or any number of other ways.
CVE-2023-0465 - we don't enable policy processing
CVE-2023-0466 - we don't enable policy processing