CVE-2020-10759: 
Rocky Linux vulnerability analysis and mitigation

CVE-2020-10759 is a PGP signature bypass vulnerability discovered in fwupd (all versions), which could potentially lead to the installation of unsigned firmware. The vulnerability was discovered in March 2020 and disclosed in June 2020. The issue affects the fwupd firmware update daemon, which is used in various Linux distributions for managing firmware updates (NVD, RedHat).

The vulnerability exists in the PGP signature verification process of fwupd. The flaw allows bypassing signature verification when a non-detached signature signed by any key is provided, instead of the expected detached signature. This vulnerability has a CVSS v3.1 Base Score of 6.0 (MEDIUM) with vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N (NVD).

While the vulnerability could theoretically allow an attacker to install unsigned firmware, its practical impact is limited. The Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8, making exploitation impractical in these environments. The highest threat from this vulnerability is to system confidentiality and integrity (NVD).

The vulnerability can be exploited by an attacker who can either compromise HTTPS connections to a fwupd metadata repository, gain privileged position within a public fwupd metadata repository, or control a local metadata mirror. However, exploitation requires user interaction as firmware updates are not installed automatically (GitHub Advisory).

The vulnerability was fixed in fwupd prior to version 1.4.0 by backporting a patch (commit 21f2d12), and in fwupd version 1.4.0 onwards by updating libjcat to include commit 839b89f. Users should update to patched versions of fwupd to mitigate this vulnerability (RedHat).