{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"High" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"edk2 security update", "category":"general", "title":"Synopsis" }, { "text":"An update for edk2 is now available for openEuler-24.03-LTS-SP1", "category":"general", "title":"Summary" }, { "text":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\n\nSecurity Fix(es):\n\nValidating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.(CVE-2024-41996)", "category":"general", "title":"Description" }, { "text":"An update for edk2 is now available for openEuler-24.03-LTS-SP1.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"High", "category":"general", "title":"Severity" }, { "text":"edk2", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-3419", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3419" }, { "summary":"CVE-2024-41996", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-41996&packageName=edk2" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41996" }, { "summary":"openEuler-SA-2026-3419 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-3419.json" } ], "title":"An update for edk2 is now available for openEuler-24.03-LTS-SP1", "tracking":{ "initial_release_date":"2026-08-26T11:02:18+08:00", "revision_history":[ { "date":"2026-08-26T11:02:18+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-08-26T11:02:18+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-08-26T11:02:18+08:00", "id":"openEuler-SA-2026-3419", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"openEuler-24.03-LTS-SP1", "name":"openEuler-24.03-LTS-SP1" }, "name":"openEuler-24.03-LTS-SP1", "category":"product_version" } ], "category":"product_name" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"edk2-202308-43.oe2403sp1.src.rpm", "name":"edk2-202308-43.oe2403sp1.src.rpm" }, "name":"edk2-202308-43.oe2403sp1.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"noarch", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"edk2-aarch64-202308-43.oe2403sp1.noarch.rpm", "name":"edk2-aarch64-202308-43.oe2403sp1.noarch.rpm" }, "name":"edk2-aarch64-202308-43.oe2403sp1.noarch.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"edk2-help-202308-43.oe2403sp1.noarch.rpm", "name":"edk2-help-202308-43.oe2403sp1.noarch.rpm" }, "name":"edk2-help-202308-43.oe2403sp1.noarch.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"edk2-ovmf-202308-43.oe2403sp1.noarch.rpm", "name":"edk2-ovmf-202308-43.oe2403sp1.noarch.rpm" }, "name":"edk2-ovmf-202308-43.oe2403sp1.noarch.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"python3-edk2-devel-202308-43.oe2403sp1.noarch.rpm", "name":"python3-edk2-devel-202308-43.oe2403sp1.noarch.rpm" }, "name":"python3-edk2-devel-202308-43.oe2403sp1.noarch.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"edk2-debuginfo-202308-43.oe2403sp1.aarch64.rpm", "name":"edk2-debuginfo-202308-43.oe2403sp1.aarch64.rpm" }, "name":"edk2-debuginfo-202308-43.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"edk2-debugsource-202308-43.oe2403sp1.aarch64.rpm", "name":"edk2-debugsource-202308-43.oe2403sp1.aarch64.rpm" }, "name":"edk2-debugsource-202308-43.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"edk2-devel-202308-43.oe2403sp1.aarch64.rpm", "name":"edk2-devel-202308-43.oe2403sp1.aarch64.rpm" }, "name":"edk2-devel-202308-43.oe2403sp1.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"edk2-debuginfo-202308-43.oe2403sp1.x86_64.rpm", "name":"edk2-debuginfo-202308-43.oe2403sp1.x86_64.rpm" }, "name":"edk2-debuginfo-202308-43.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"edk2-debugsource-202308-43.oe2403sp1.x86_64.rpm", "name":"edk2-debugsource-202308-43.oe2403sp1.x86_64.rpm" }, "name":"edk2-debugsource-202308-43.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"edk2-devel-202308-43.oe2403sp1.x86_64.rpm", "name":"edk2-devel-202308-43.oe2403sp1.x86_64.rpm" }, "name":"edk2-devel-202308-43.oe2403sp1.x86_64.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"edk2-202308-43.oe2403sp1.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:edk2-202308-43.oe2403sp1.src", "name":"edk2-202308-43.oe2403sp1.src as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"edk2-aarch64-202308-43.oe2403sp1.noarch.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:edk2-aarch64-202308-43.oe2403sp1.noarch", "name":"edk2-aarch64-202308-43.oe2403sp1.noarch as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"edk2-help-202308-43.oe2403sp1.noarch.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:edk2-help-202308-43.oe2403sp1.noarch", "name":"edk2-help-202308-43.oe2403sp1.noarch as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"edk2-ovmf-202308-43.oe2403sp1.noarch.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:edk2-ovmf-202308-43.oe2403sp1.noarch", "name":"edk2-ovmf-202308-43.oe2403sp1.noarch as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"python3-edk2-devel-202308-43.oe2403sp1.noarch.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:python3-edk2-devel-202308-43.oe2403sp1.noarch", "name":"python3-edk2-devel-202308-43.oe2403sp1.noarch as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"edk2-debuginfo-202308-43.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:edk2-debuginfo-202308-43.oe2403sp1.aarch64", "name":"edk2-debuginfo-202308-43.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"edk2-debugsource-202308-43.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:edk2-debugsource-202308-43.oe2403sp1.aarch64", "name":"edk2-debugsource-202308-43.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"edk2-devel-202308-43.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:edk2-devel-202308-43.oe2403sp1.aarch64", "name":"edk2-devel-202308-43.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"edk2-debuginfo-202308-43.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:edk2-debuginfo-202308-43.oe2403sp1.x86_64", "name":"edk2-debuginfo-202308-43.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"edk2-debugsource-202308-43.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:edk2-debugsource-202308-43.oe2403sp1.x86_64", "name":"edk2-debugsource-202308-43.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"edk2-devel-202308-43.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:edk2-devel-202308-43.oe2403sp1.x86_64", "name":"edk2-devel-202308-43.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2024-41996", "notes":[ { "text":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:edk2-202308-43.oe2403sp1.src", "openEuler-24.03-LTS-SP1:edk2-aarch64-202308-43.oe2403sp1.noarch", "openEuler-24.03-LTS-SP1:edk2-help-202308-43.oe2403sp1.noarch", "openEuler-24.03-LTS-SP1:edk2-ovmf-202308-43.oe2403sp1.noarch", "openEuler-24.03-LTS-SP1:python3-edk2-devel-202308-43.oe2403sp1.noarch", "openEuler-24.03-LTS-SP1:edk2-debuginfo-202308-43.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:edk2-debugsource-202308-43.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:edk2-devel-202308-43.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:edk2-debuginfo-202308-43.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:edk2-debugsource-202308-43.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:edk2-devel-202308-43.oe2403sp1.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:edk2-202308-43.oe2403sp1.src", "openEuler-24.03-LTS-SP1:edk2-aarch64-202308-43.oe2403sp1.noarch", "openEuler-24.03-LTS-SP1:edk2-help-202308-43.oe2403sp1.noarch", "openEuler-24.03-LTS-SP1:edk2-ovmf-202308-43.oe2403sp1.noarch", "openEuler-24.03-LTS-SP1:python3-edk2-devel-202308-43.oe2403sp1.noarch", "openEuler-24.03-LTS-SP1:edk2-debuginfo-202308-43.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:edk2-debugsource-202308-43.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:edk2-devel-202308-43.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:edk2-debuginfo-202308-43.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:edk2-debugsource-202308-43.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:edk2-devel-202308-43.oe2403sp1.x86_64" ], "details":"edk2 security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3419" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:edk2-202308-43.oe2403sp1.src", "openEuler-24.03-LTS-SP1:edk2-aarch64-202308-43.oe2403sp1.noarch", "openEuler-24.03-LTS-SP1:edk2-help-202308-43.oe2403sp1.noarch", "openEuler-24.03-LTS-SP1:edk2-ovmf-202308-43.oe2403sp1.noarch", "openEuler-24.03-LTS-SP1:python3-edk2-devel-202308-43.oe2403sp1.noarch", "openEuler-24.03-LTS-SP1:edk2-debuginfo-202308-43.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:edk2-debugsource-202308-43.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:edk2-devel-202308-43.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:edk2-debuginfo-202308-43.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:edk2-debugsource-202308-43.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:edk2-devel-202308-43.oe2403sp1.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2024-41996" } ] }