2 lines
4.4 KiB
JSON
2 lines
4.4 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["AAVMF UEFI Shell"],"platforms":["aarch64"],"product":"edk2","vendor":"Ubuntu","versions":[{"lessThan":"2024.05-2ubuntu0.3","status":"affected","version":"2024.05","versionType":"dpkg"},{"lessThan":"2024.02-2ubuntu0.3","status":"affected","version":"2024.02","versionType":"dpkg"}]}],"source":"security@ubuntu.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tianocore:edk2:202402*:*:*:*:*:*:*:*","matchCriteriaId":"AEEAC129-5714-416C-B689-09707A561451","vulnerable":true},{"criteria":"cpe:2.3:a:tianocore:edk2:202405:*:*:*:*:*:*:*","matchCriteriaId":"67420046-C0C1-4B20-9B5F-A1F4ED477798","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shell. Some previous versions inserted a secure-boot-based decision to continue running inside the Shell itself, which is believed to be sufficient to enforce Secure Boot restrictions. This is an additional repair on top of the incomplete fix for CVE-2023-48733."},{"lang":"es","value":"Los paquetes de firmware UEFI edk2 de Ubuntu permitieron accidentalmente el acceso al Shell UEFI en entornos con Secure Boot, lo que posiblemente permitía eludir las restricciones de Secure Boot. Las versiones 2024.05-2ubuntu0.3 y 2024.02-2ubuntu0.3 deshabilitan el Shell. Algunas versiones anteriores insertaron una decisión basada en Secure Boot para continuar ejecutándose dentro del propio Shell, lo que se cree que es suficiente para hacer cumplir las restricciones de Secure Boot. Esta es una reparación adicional además de la corrección incompleta para CVE-2023-48733."}],"id":"CVE-2025-2486","lastModified":"2026-10-18T20:10:00.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":3.7,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@ubuntu.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-2486","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-11-26T18:25:19.164474Z","version":"2.0.3"}}]},"published":"2025-11-26T18:15:48.357","references":[{"source":"security@ubuntu.com","tags":["Patch","Third Party Advisory"],"url":"https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2101797"}],"sourceIdentifier":"security@ubuntu.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-489"}],"source":"security@ubuntu.com","type":"Secondary"}]}
|