Threats affecting pkg:rpm/redhat/edk2

A security vulnerability (CVE-2025-2296) in the edk2 package used by Red Hat Enterprise Linux 10 allows arbitrary command execution due to improper input validation. The edk2 package provides UEFI firmware support for virtual machines such as QEMU and KVM. Red Hat has released an important security update addressing this issue for multiple architectures and variants of Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products.

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Integer overflows in PeCoffLoaderRelocateImage (CVE-2024-38796) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: Possible denial of service in X.509 name checks (CVE-2024-6119) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.