Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected], Steve McIntyre <[email protected]> Control: affects -1 + src:fwupd-efi User: [email protected] Usertags: pu
[ Reason ] Security advisory https://www.binarly.io/advisories/brly-2026-062 has a secure boot bypass for fwupd-efi. This should be fixed in trixie. [ Impact ] Secure boot can be bypassed. (What is the impact for the user if the update isn't approved?) [ Tests ] Manually loading EFI binary in a VM or on a real system. [ Risks ] Limited to fwupd-efi. Could break firmware updates if the binary is no longer able to execute. Conversely; the hashes for the vulnerable binary should be included in a dbx and if this isn't updated then firmware updates may no longer work. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [ ] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] Upgrade source tree to 1.9. The d/* changes are: * d/control: standards version (unstable bumped it) * d/control: maintainer (my debian.org address) * d/control: build deps (missing pkgconf) * d/rules: need new arg for 1.9 * d/changelog: duh [ Other info ] I want to do this as a straight rebuild from forky source. This is because although this vulnerability was flagged; many others were found earlier this year that weren't issued advisories. We may still have exposure to issues if we only backport the fix for this advisory.
