CVE catalog

CVE-2020-27749

grub2 affected and fixed versions

[CVE catalog]

A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Severity
High · CVSS 7.5CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.57% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixiegrub22.04-16FixedDistribution-reported fixed boundary[CVE-2020-27749]
Debiantrixiegrub22.12-9+deb13u2Fixed[CVE-2020-27749]
Debiansidgrub22.04-16FixedDistribution-reported fixed boundary[CVE-2020-27749]
Debiansidgrub22.14-4Fixed[CVE-2020-27749]
Debianforkygrub22.04-16FixedDistribution-reported fixed boundary[CVE-2020-27749]
Debianforkygrub22.14-4Fixed[CVE-2020-27749]
Debianbookworm-securitygrub22.06-13+deb12u1Fixed[CVE-2020-27749]
Debianbookwormgrub22.04-16FixedDistribution-reported fixed boundary[CVE-2020-27749]
Debianbookwormgrub22.06-13+deb12u2Fixed[CVE-2020-27749]

Showing 9 fix observations. All 104 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Alpine3.17grub2.06-r0UnknownSource applicability is not established[ALPINE-CVE-2020-27749]
Alpine3.18grub2.06-r0UnknownSource applicability is not established[ALPINE-CVE-2020-27749]
Alpine3.19grub2.06-r0UnknownSource applicability is not established[ALPINE-CVE-2020-27749]
Alpine3.20grub2.06-r0UnknownSource applicability is not established[ALPINE-CVE-2020-27749]
Alpine3.21grub2.06-r0UnknownSource applicability is not established[ALPINE-CVE-2020-27749]
Alpine3.22grub2.06-r0UnknownSource applicability is not established[ALPINE-CVE-2020-27749]
Alpine3.23grub2.06-r0UnknownSource applicability is not established[ALPINE-CVE-2020-27749]
Alpine3.24grub2.06-r0UnknownSource applicability is not established[ALPINE-CVE-2020-27749]
Debianbookwormgrub22.04-16FixedDistribution-reported fixed boundary[CVE-2020-27749]
Debianbookwormgrub22.06-13+deb12u2Fixed[CVE-2020-27749]
Debianbookworm-securitygrub22.06-13+deb12u1Fixed[CVE-2020-27749]
Debianforkygrub22.04-16FixedDistribution-reported fixed boundary[CVE-2020-27749]
Debianforkygrub22.14-4Fixed[CVE-2020-27749]
Debiansidgrub22.04-16FixedDistribution-reported fixed boundary[CVE-2020-27749]
Debiansidgrub22.14-4Fixed[CVE-2020-27749]
Debiantrixiegrub22.04-16FixedDistribution-reported fixed boundary[CVE-2020-27749]
Debiantrixiegrub22.12-9+deb13u2Fixed[CVE-2020-27749]
Ubuntu18.04grub2-signed1.167~18.04.1UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.167~18.04.3UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.167~18.04.5UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.85UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.86UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.87UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.89UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.91UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.92UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.1UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.10UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.11UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.13UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.14UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.15UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.16UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.18UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.19UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.2UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.20UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.21UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.22UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.24UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.3UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.4UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.5UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.7UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-signed1.93.8UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-unsigned2.04-1ubuntu44UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-unsigned2.04-1ubuntu44.1UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu18.04grub2-unsigned2.04-1ubuntu44.1.2UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.128UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.129UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.130UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.131UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.133UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.134UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.135UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.136UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.137UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.138UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.139UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.140UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.141UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.142UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.142.1UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.142.10UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.142.11UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.142.3UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.142.4UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.142.5UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.142.6UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.142.8UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.142.9UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.167UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-signed1.167.2UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-unsigned2.04-1ubuntu44UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntu20.04grub2-unsigned2.04-1ubuntu44.2UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.22UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.23UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.24UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.25UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.26UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.27UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.30UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.31UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.32UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.33UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.1UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.13UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.14UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.16UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.17UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.18UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.2UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.20UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.22UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.24UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.3UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.4UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.5UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.6UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.7UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.8UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Ubuntuprogrub2-signed1.34.9UnknownSource applicability is not established[UBUNTU-CVE-2020-27749]
Original provider fields
{
  "package_releases": [
    {
      "name": "grub2",
      "status": "fixed",
      "release": "sid",
      "version": "2.14-4"
    },
    {
      "name": "grub2",
      "status": "fixed",
      "release": "forky",
      "version": "2.14-4"
    },
    {
      "name": "grub2",
      "status": "fixed",
      "release": "trixie",
      "version": "2.12-9+deb13u2"
    },
    {
      "name": "grub2",
      "status": "fixed",
      "release": "bookworm",
      "version": "2.06-13+deb12u2"
    },
    {
      "name": "grub2",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "2.06-13+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "grub2",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2.04-16"
    },
    {
      "bug": null,
      "name": "grub2",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2.04-16"
    },
    {
      "bug": null,
      "name": "grub2",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2.04-16"
    },
    {
      "bug": null,
      "name": "grub2",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "2.04-16"
    }
  ],
  "distribution_packages": [
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.17",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-27749",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-27749",
      "provider_updated_at": "2026-10-26T11:17:55.162376318Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.18",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-27749",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-27749",
      "provider_updated_at": "2026-10-26T11:17:55.162376318Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.19",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-27749",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-27749",
      "provider_updated_at": "2026-10-26T11:17:55.162376318Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.20",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-27749",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-27749",
      "provider_updated_at": "2026-10-26T11:17:55.162376318Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.21",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-27749",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-27749",
      "provider_updated_at": "2026-10-26T11:17:55.162376318Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.22",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-27749",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-27749",
      "provider_updated_at": "2026-10-26T11:17:55.162376318Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.23",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-27749",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-27749",
      "provider_updated_at": "2026-10-26T11:17:55.162376318Z",
      "applicability_unknown": true
    },
    {
      "name": "grub",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.06-r0"
            }
          ]
        }
      ],
      "release": "3.24",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-27749",
      "fixed_version": "2.06-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2020-27749",
      "provider_updated_at": "2026-10-26T11:17:55.162376318Z",
      "applicability_unknown": true
    },
    {
      "name": "grub2-signed",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.22",
        "1.23",
        "1.24",
        "1.25",
        "1.26",
        "1.27",
        "1.30",
        "1.31",
        "1.32",
        "1.33",
        "1.34",
        "1.34.1",
        "1.34.2",
        "1.34.3",
        "1.34.4",
        "1.34.5",
        "1.34.6",
        "1.34.7",
        "1.34.8",
        "1.34.9",
        "1.34.13",
        "1.34.14",
        "1.34.16",
        "1.34.17",
        "1.34.18",
        "1.34.20",
        "1.34.22",
        "1.34.24"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-27749",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-27749",
      "provider_updated_at": "2026-02-04T03:59:22.900069Z",
      "applicability_unknown": true
    },
    {
      "name": "grub2-signed",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.167~18.04.5"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.85",
        "1.86",
        "1.87",
        "1.89",
        "1.91",
        "1.92",
        "1.93",
        "1.93.1",
        "1.93.2",
        "1.93.3",
        "1.93.4",
        "1.93.5",
        "1.93.7",
        "1.93.8",
        "1.93.10",
        "1.93.11",
        "1.93.13",
        "1.93.14",
        "1.93.15",
        "1.93.16",
        "1.93.18",
        "1.93.19",
        "1.93.20",
        "1.93.21",
        "1.93.22",
        "1.93.24",
        "1.167~18.04.1",
        "1.167~18.04.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-27749",
      "fixed_version": "1.167~18.04.5",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-27749",
      "provider_updated_at": "2026-02-04T03:59:22.900069Z",
      "applicability_unknown": true
    },
    {
      "name": "grub2-unsigned",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.04-1ubuntu44.1.2"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "2.04-1ubuntu44",
        "2.04-1ubuntu44.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-27749",
      "fixed_version": "2.04-1ubuntu44.1.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-27749",
      "provider_updated_at": "2026-02-04T03:59:22.900069Z",
      "applicability_unknown": true
    },
    {
      "name": "grub2-signed",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.167.2"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.128",
        "1.129",
        "1.130",
        "1.131",
        "1.133",
        "1.134",
        "1.135",
        "1.136",
        "1.137",
        "1.138",
        "1.139",
        "1.140",
        "1.141",
        "1.142",
        "1.142.1",
        "1.142.3",
        "1.142.4",
        "1.142.5",
        "1.142.6",
        "1.142.8",
        "1.142.9",
        "1.142.10",
        "1.142.11",
        "1.167"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-27749",
      "fixed_version": "1.167.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-27749",
      "provider_updated_at": "2026-02-04T03:59:22.900069Z",
      "applicability_unknown": true
    },
    {
      "name": "grub2-unsigned",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.04-1ubuntu44.2"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.04-1ubuntu44"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-27749",
      "fixed_version": "2.04-1ubuntu44.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-27749",
      "provider_updated_at": "2026-02-04T03:59:22.900069Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [grub2]Unknown
    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub2-common]Unknown

    Source package: [grub2]

    Details (6)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-common]Unknown

    Source package: [grub2]

    Details (6)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-coreboot]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-coreboot-bin]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-coreboot-dbg]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-efi]Unknown

    Source package: [grub2]

    Details (6)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-efi-amd64]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-efi-amd64-bin]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-efi-amd64-dbg]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-efi-amd64-signed-template]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-efi-arm64]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-efi-arm64-bin]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-efi-arm64-dbg]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-efi-arm64-signed-template]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-efi-ia32]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-efi-ia32-bin]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-efi-ia32-dbg]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-emu]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

  • [grub-emu-dbg]Unknown

    Source package: [grub2]

    Details (3)

    • 2.06-13+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.12-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

    • 2.06-13+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.04-16

      dsa · grub2 · debian · bookworm; dsa · grub2 · debian · 12

Next results

Observed:

References

[CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]