CVE catalog

CVE-2020-10759

fwupd: CVE-2020-10759

Severity: High · CVSS 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: Jun 5, 2020, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.49% · Oct 25, 2026

A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. The highest threat from this vulnerability is to confidentiality and integrity.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	fwupd	sid	`2.1.8-1`	fixed
Debian	fwupd	forky	`2.1.8-1`	fixed
Debian	fwupd	trixie	`2.0.20-1~deb13u1`	fixed
Debian	fwupd	bookworm	`2.0.20-1~deb12u2`	fixed
Debian	libjcat	sid	`0.2.5-1`	fixed
Debian	libjcat	forky	`0.2.5-1`	fixed
Debian	libjcat	trixie	`0.2.3-1`	fixed
Debian	libjcat	bookworm	`0.2.3-1~deb12u1`	fixed
Ubuntu	fwupd	16.04	`0.1.5-0ubuntu3`	vulnerable
Ubuntu	fwupd	16.04	`0.6.0-1`	vulnerable
Ubuntu	fwupd	16.04	`0.6.2-1`	vulnerable
Ubuntu	fwupd	16.04	`0.6.2-1ubuntu1`	vulnerable
Ubuntu	fwupd	16.04	`0.6.2-1ubuntu2`	vulnerable
Ubuntu	fwupd	16.04	`0.6.2-1ubuntu3`	vulnerable
Ubuntu	fwupd	16.04	`0.6.3-0ubuntu2`	vulnerable
Ubuntu	fwupd	16.04	`0.7.0-0ubuntu2`	vulnerable
Ubuntu	fwupd	16.04	`0.7.0-0ubuntu3`	vulnerable
Ubuntu	fwupd	16.04	`0.7.0-0ubuntu4`	vulnerable
Ubuntu	fwupd	16.04	`0.7.0-0ubuntu4.1`	vulnerable
Ubuntu	fwupd	16.04	`0.7.0-0ubuntu4.2`	vulnerable
Ubuntu	fwupd	16.04	`0.7.0-0ubuntu4.3`	vulnerable
Ubuntu	fwupd	16.04	`0.8.3-0ubuntu2`	vulnerable
Ubuntu	fwupd	16.04	`0.8.3-0ubuntu3`	vulnerable
Ubuntu	fwupd	16.04	`0.8.3-0ubuntu4`	vulnerable
Ubuntu	fwupd	16.04	`0.8.3-0ubuntu5`	vulnerable
Ubuntu	fwupd	16.04	`0.8.3-0ubuntu5.1`	fixed
Ubuntu	fwupd	18.04	`0.9.7-2`	vulnerable
Ubuntu	fwupd	18.04	`1.0.0-4`	vulnerable
Ubuntu	fwupd	18.04	`1.0.0-5`	vulnerable
Ubuntu	fwupd	18.04	`1.0.1-2`	vulnerable
Ubuntu	fwupd	18.04	`1.0.2-1`	vulnerable
Ubuntu	fwupd	18.04	`1.0.4-3`	vulnerable
Ubuntu	fwupd	18.04	`1.0.4-3build1`	vulnerable
Ubuntu	fwupd	18.04	`1.0.5-1`	vulnerable
Ubuntu	fwupd	18.04	`1.0.6-2`	vulnerable
Ubuntu	fwupd	18.04	`1.0.9-0ubuntu2`	vulnerable
Ubuntu	fwupd	18.04	`1.2.10-1ubuntu2~ubuntu18.04.3`	vulnerable
Ubuntu	fwupd	18.04	`1.2.10-1ubuntu2~ubuntu18.04.5`	fixed
Ubuntu	fwupd	20.04	`1.2.10-1ubuntu2`	vulnerable
Ubuntu	fwupd	20.04	`1.3.3-3`	vulnerable
Ubuntu	fwupd	20.04	`1.3.5-1`	vulnerable
Ubuntu	fwupd	20.04	`1.3.6-1ubuntu1`	vulnerable
Ubuntu	fwupd	20.04	`1.3.7-2`	vulnerable
Ubuntu	fwupd	20.04	`1.3.7-3`	vulnerable
Ubuntu	fwupd	20.04	`1.3.8-1`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-1`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-1build1`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-2`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-2build1`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-3`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-4`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-4ubuntu0.1`	fixed
Ubuntu	fwupd	16.04	`0.1.5-0ubuntu3`	vulnerable
Ubuntu	fwupd	16.04	`0.6.0-1`	vulnerable
Ubuntu	fwupd	16.04	`0.6.2-1`	vulnerable
Ubuntu	fwupd	16.04	`0.6.2-1ubuntu1`	vulnerable
Ubuntu	fwupd	16.04	`0.6.2-1ubuntu2`	vulnerable
Ubuntu	fwupd	16.04	`0.6.2-1ubuntu3`	vulnerable
Ubuntu	fwupd	16.04	`0.6.3-0ubuntu2`	vulnerable
Ubuntu	fwupd	16.04	`0.7.0-0ubuntu2`	vulnerable
Ubuntu	fwupd	16.04	`0.7.0-0ubuntu3`	vulnerable
Ubuntu	fwupd	16.04	`0.7.0-0ubuntu4`	vulnerable
Ubuntu	fwupd	16.04	`0.7.0-0ubuntu4.1`	vulnerable
Ubuntu	fwupd	16.04	`0.7.0-0ubuntu4.2`	vulnerable
Ubuntu	fwupd	16.04	`0.7.0-0ubuntu4.3`	vulnerable
Ubuntu	fwupd	16.04	`0.8.3-0ubuntu2`	vulnerable
Ubuntu	fwupd	16.04	`0.8.3-0ubuntu3`	vulnerable
Ubuntu	fwupd	16.04	`0.8.3-0ubuntu4`	vulnerable
Ubuntu	fwupd	16.04	`0.8.3-0ubuntu5`	vulnerable
Ubuntu	fwupd	16.04	`0.8.3-0ubuntu5.1`	fixed
Ubuntu	fwupd	18.04	`0.9.7-2`	vulnerable
Ubuntu	fwupd	18.04	`1.0.0-4`	vulnerable
Ubuntu	fwupd	18.04	`1.0.0-5`	vulnerable
Ubuntu	fwupd	18.04	`1.0.1-2`	vulnerable
Ubuntu	fwupd	18.04	`1.0.2-1`	vulnerable
Ubuntu	fwupd	18.04	`1.0.4-3`	vulnerable
Ubuntu	fwupd	18.04	`1.0.4-3build1`	vulnerable
Ubuntu	fwupd	18.04	`1.0.5-1`	vulnerable
Ubuntu	fwupd	18.04	`1.0.6-2`	vulnerable
Ubuntu	fwupd	18.04	`1.0.9-0ubuntu2`	vulnerable
Ubuntu	fwupd	18.04	`1.2.10-1ubuntu2~ubuntu18.04.3`	vulnerable
Ubuntu	fwupd	18.04	`1.2.10-1ubuntu2~ubuntu18.04.5`	fixed
Ubuntu	fwupd	20.04	`1.2.10-1ubuntu2`	vulnerable
Ubuntu	fwupd	20.04	`1.3.3-3`	vulnerable
Ubuntu	fwupd	20.04	`1.3.5-1`	vulnerable
Ubuntu	fwupd	20.04	`1.3.6-1ubuntu1`	vulnerable
Ubuntu	fwupd	20.04	`1.3.7-2`	vulnerable
Ubuntu	fwupd	20.04	`1.3.7-3`	vulnerable
Ubuntu	fwupd	20.04	`1.3.8-1`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-1`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-1build1`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-2`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-2build1`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-3`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-4`	vulnerable
Ubuntu	fwupd	20.04	`1.3.9-4ubuntu0.1`	fixed
Opensuse	fwupd	leap 15.1	`1.0.9-lp151.2.3.1`	fixed
Opensuse	fwupd	leap 15.2	`1.2.14-lp152.3.9.1`	fixed
Opensuse	fwupd	tumbleweed	`1.5.8-1.5`	fixed
Suse	fwupd	linux enterprise module for desktop applications 15 sp1	`1.0.9-6.3.1`	fixed
Suse	fwupd	linux enterprise module for desktop applications 15 sp2	`1.2.14-5.8.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	fwupd	source	sid	`1.3.10-1`	not yet assigned	Not reported	[962517]
Debian	fwupd	source	forky	`1.3.10-1`	not yet assigned	Not reported	[962517]
Debian	fwupd	source	trixie	`1.3.10-1`	not yet assigned	Not reported	[962517]
Debian	fwupd	source	bookworm	`1.3.10-1`	not yet assigned	Not reported	[962517]
Debian	libjcat	source	sid	`0.1.3-1`	not yet assigned	Not reported	Not reported
Debian	libjcat	source	forky	`0.1.3-1`	not yet assigned	Not reported	Not reported
Debian	libjcat	source	trixie	`0.1.3-1`	not yet assigned	Not reported	Not reported
Debian	libjcat	source	bookworm	`0.1.3-1`	not yet assigned	Not reported	Not reported
Ubuntu	fwupd	deb	16.04	`0.8.3-0ubuntu5.1`	Not reported	UBUNTU-CVE-2020-10759	Not reported
Ubuntu	fwupd	deb	18.04	`1.2.10-1ubuntu2~ubuntu18.04.5`	Not reported	UBUNTU-CVE-2020-10759	Not reported
Ubuntu	fwupd	deb	20.04	`1.3.9-4ubuntu0.1`	Not reported	UBUNTU-CVE-2020-10759	Not reported
Ubuntu	fwupd	deb	16.04	`0.8.3-0ubuntu5.1`	Not reported	USN-4395-1	Not reported
Ubuntu	fwupd	deb	18.04	`1.2.10-1ubuntu2~ubuntu18.04.5`	Not reported	USN-4395-1	Not reported
Ubuntu	fwupd	deb	20.04	`1.3.9-4ubuntu0.1`	Not reported	USN-4395-1	Not reported
Opensuse	fwupd	rpm	leap 15.1	`1.0.9-lp151.2.3.1`	Not reported	OPENSUSE-SU-2020:0849-1	Not reported
Opensuse	fwupd	rpm	leap 15.2	`1.2.14-lp152.3.9.1`	Not reported	OPENSUSE-SU-2021:0522-1	Not reported
Opensuse	fwupd	rpm	tumbleweed	`1.5.8-1.5`	Not reported	OPENSUSE-SU-2024:10774-1	Not reported
Suse	fwupd	rpm	linux enterprise module for desktop applications 15 sp1	`1.0.9-6.3.1`	Not reported	SUSE-SU-2020:1681-1	Not reported
Suse	fwupd	rpm	linux enterprise module for desktop applications 15 sp2	`1.2.14-5.8.2`	Not reported	SUSE-SU-2021:1107-1	Not reported

[Debian bug #962517]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[fwupd-bash-completion]Unknown
Source package: [fwupd]
Details (1)
- 2.1.7-2.1 · noarch · tumbleweed
  Unknown · Fixed: 1.5.8-1.5
  Version impact unknown
  dsa · fwupd · opensuse · tumbleweed
[fwupd-devel]Unknown
Source package: [fwupd]
Details (1)
- 2.1.7-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.5.8-1.5
  Version impact unknown
  dsa · fwupd · opensuse · tumbleweed
[fwupd-doc]Unknown
Source package: [fwupd]
Details (1)
- 2.1.7-2.1 · noarch · tumbleweed
  Unknown · Fixed: 1.5.8-1.5
  Version impact unknown
  dsa · fwupd · opensuse · tumbleweed
[fwupd-fish-completion]Unknown
Source package: [fwupd]
Details (1)
- 2.1.7-2.1 · noarch · tumbleweed
  Unknown · Fixed: 1.5.8-1.5
  Version impact unknown
  dsa · fwupd · opensuse · tumbleweed
[fwupd-lang]Unknown
Source package: [fwupd]
Details (1)
- 2.1.7-2.1 · noarch · tumbleweed
  Unknown · Fixed: 1.5.8-1.5
  Version impact unknown
  dsa · fwupd · opensuse · tumbleweed
[fwupd-tests]Unknown
Source package: [fwupd]
Details (1)
- 2.1.7-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.5.8-1.5
  Version impact unknown
  dsa · fwupd · opensuse · tumbleweed
[libfwupd3]Unknown
Source package: [fwupd]
Details (1)
- 2.1.7-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.5.8-1.5
  Version impact unknown
  dsa · fwupd · opensuse · tumbleweed
[typelib-1_0-Fwupd-2_0]Unknown
Source package: [fwupd]
Details (1)
- 2.1.7-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.5.8-1.5
  Version impact unknown
  dsa · fwupd · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[fwupd]Fixed
Details (2)
- 2.0.20-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · bookworm; dsa · fwupd · debian · 12
- 2.0.20-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · bookworm; dsa · fwupd · debian · 12
[fwupd-doc]Fixed
Source package: [fwupd]
Details (2)
- 2.0.20-1~deb12u2 · all · bookworm
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · bookworm; dsa · fwupd · debian · 12
- 2.0.20-1~deb12u2 · all · bookworm
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · bookworm; dsa · fwupd · debian · 12
[fwupd-tests]Fixed
Source package: [fwupd]
Details (2)
- 2.0.20-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · bookworm; dsa · fwupd · debian · 12
- 2.0.20-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · bookworm; dsa · fwupd · debian · 12
[gir1.2-fwupd-2.0]Fixed
Source package: [fwupd]
Details (2)
- 2.0.20-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · bookworm; dsa · fwupd · debian · 12
- 2.0.20-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · bookworm; dsa · fwupd · debian · 12
[gir1.2-jcat-1.0]Fixed
Source package: [libjcat]
Details (2)
- 0.2.3-1~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.1.3-1
  dsa · libjcat · debian · bookworm; dsa · libjcat · debian · 12
- 0.2.3-1~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.1.3-1
  dsa · libjcat · debian · bookworm; dsa · libjcat · debian · 12
[jcat]Fixed
Source package: [libjcat]
Details (2)
- 0.2.3-1~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.1.3-1
  dsa · libjcat · debian · bookworm; dsa · libjcat · debian · 12
- 0.2.3-1~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.1.3-1
  dsa · libjcat · debian · bookworm; dsa · libjcat · debian · 12
[libfwupd3]Fixed
Source package: [fwupd]
Details (2)
- 2.0.20-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · bookworm; dsa · fwupd · debian · 12
- 2.0.20-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · bookworm; dsa · fwupd · debian · 12
[libfwupd-dev]Fixed
Source package: [fwupd]
Details (2)
- 2.0.20-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · bookworm; dsa · fwupd · debian · 12
- 2.0.20-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · bookworm; dsa · fwupd · debian · 12
[libjcat1]Fixed
Source package: [libjcat]
Details (2)
- 0.2.3-1~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.1.3-1
  dsa · libjcat · debian · bookworm; dsa · libjcat · debian · 12
- 0.2.3-1~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.1.3-1
  dsa · libjcat · debian · bookworm; dsa · libjcat · debian · 12
[libjcat-dev]Fixed
Source package: [libjcat]
Details (2)
- 0.2.3-1~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.1.3-1
  dsa · libjcat · debian · bookworm; dsa · libjcat · debian · 12
- 0.2.3-1~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.1.3-1
  dsa · libjcat · debian · bookworm; dsa · libjcat · debian · 12
[libjcat-tests]Fixed
Source package: [libjcat]
Details (2)
- 0.2.3-1~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.1.3-1
  dsa · libjcat · debian · bookworm; dsa · libjcat · debian · 12
- 0.2.3-1~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.1.3-1
  dsa · libjcat · debian · bookworm; dsa · libjcat · debian · 12

[Debian 13 (Trixie)]

[fwupd]Fixed
Details (4)
- 2.0.20-1~deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · 13
- 2.0.20-1~deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · 13
- 2.1.7-4~bpo13+1 · amd64 · trixie-backports
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · 13
- 2.1.7-4~bpo13+1 · arm64 · trixie-backports
  Fixed · Fixed: 1.3.10-1
  dsa · fwupd · debian · 13

Next results

Observed: Oct 23, 2026, 5:46:29 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]