sbat: Add grub.peimage,2 to latest (CVE-2024-2312)

rhboot / shim

UEFI shim loader

Other

816 stars 284 forks source link

sbat: Add grub.peimage,2 to latest (CVE-2024-2312) #651

Closed julian-klode closed 2 months ago

julian-klode commented 3 months ago

Add the previous latest level to the switch for automatic.

julian-klode commented 3 months ago

I guess to note:

This only affects Debian testing, unstable, Ubuntu mantic and the in-development noble
I've not bumped the default previous level, but recorded the previous latest level as a possible previous one

julian-klode commented 3 months ago

There's a question if we should also bump that latest to grub,4 now and drop the grub,debian entry. It's been what, 3 months now? We should do it before we get another round of CVEs and need to bump grub again, otherwise grub is going to be at grub,3 in previous and grub,5 in latest which would be messy.

kukrimate commented 2 months ago

I think latest should be "grub,4".

I think ideally latest should have been "grub,4" at the time of the 15.8, it would make sense that the actually secure revocations at the time of a specific shim release are always available as an opt in. In this case it made sense for people not affected by the NTFS CVE but still.

vathpela commented 2 months ago

This looks good to me, as would updating to grub,4 and removing grub.debian in a different PR.