edk2 accepts invalid certificates in HTTPS-over-IPv6 boot, which would allow an attacker to perform a man-in-the-middle attack even when HTTPS is used. In particular, the Common Name (CN) of the certificate is not correctly checked, thus the boot succeeds even if it should not be performed. Upstream issue: https://bugzilla.tianocore.org/show_bug.cgi?id=960
Created edk2 tracking bugs for this issue: Affects: epel-all [bug 1758521] Affects: fedora-all [bug 1758519]
Proposed upstream patch: https://www.mail-archive.com/devel@edk2.groups.io/msg09286.html
This issue has been fixed in upstream edk2 today: https://bugzilla.tianocore.org/show_bug.cgi?id=960#c45 https://bugzilla.tianocore.org/show_bug.cgi?id=960#c46 https://bugzilla.tianocore.org/show_bug.cgi?id=960#c47
Upstream fix: https://github.com/tianocore/edk2/compare/b15646484eaf...e2fc50812895
Statement: This issue did not affect the versions of edk2/ovmf as shipped with Red Hat Enterprise Linux 7, and 8 as they did not include support for HTTP boot nor TLS. Compile time options HTTP_BOOT_ENABLE and TLS_ENABLE are both disabled in the shipped packages.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-14553