CVE catalog

CVE-2023-45237

EDK II vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.99% · Oct 25, 2026

A security flaw has been identified in the cryptographic system of EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized remote attacker to potentially expose sensitive information. edk2: Use of a Weak PseudoRandom Number Generator The identified flaw in the NetworkPkg IP stack within the EDK2, an open-source UEFI implementation, poses a moderate security concern as the vulnerability allows an unauthenticated attacker within the same local network to exploit via a specifically crafted Destination Options IPv6 header. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianedk2sid2026.08+ds-2fixed
Debianedk2forky2026.08+ds-2fixed
Debianedk2trixie2025.02-8+deb13u1fixed
Debianedk2bookworm2022.11-6+deb12u2vulnerable
Debianedk2bookworm-security2022.11-6+deb12u1vulnerable
Ubuntuedk2nobleNot reportedvulnerable
Ubuntuedk2noble2024.02-2ubuntu0.6fixed
Ubuntuefi-shell-aa64noble2024.02-2ubuntu0.6fixed
Ubuntuefi-shell-armnoble2024.02-2ubuntu0.6fixed
Ubuntuefi-shell-ia32noble2024.02-2ubuntu0.6fixed
Ubuntuefi-shell-riscv64noble2024.02-2ubuntu0.6fixed
Ubuntuefi-shell-x64noble2024.02-2ubuntu0.6fixed
Ubuntuovmfnoble2024.02-2ubuntu0.6fixed
Ubuntuovmf-ia32noble2024.02-2ubuntu0.6fixed
Ubuntuqemu-efi-aarch64noble2024.02-2ubuntu0.6fixed
Ubuntuqemu-efi-armnoble2024.02-2ubuntu0.6fixed
Ubuntuqemu-efi-riscv64noble2024.02-2ubuntu0.6fixed
Ubuntuedk2pro0~20190606.20d2e5a1-2ubuntu1vulnerable
Ubuntuedk2pro0~20190828.37eef910-3vulnerable
Ubuntuedk2pro0~20190828.37eef910-4vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-1vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-1ubuntu1vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu1vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu2vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.1vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.2vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.3vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.4vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.5vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.6vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.6+esm1vulnerable
Ubuntuedk222.042021.08~rc0-2vulnerable
Ubuntuedk222.042021.08-3vulnerable
Ubuntuedk222.042021.11~rc1-1vulnerable
Ubuntuedk222.042021.11-1vulnerable
Ubuntuedk222.042021.11-2vulnerable
Ubuntuedk222.042022.02~rc1-1vulnerable
Ubuntuedk222.042022.02~rc1-1ubuntu1vulnerable
Ubuntuedk222.042022.02-1vulnerable
Ubuntuedk222.042022.02-2vulnerable
Ubuntuedk222.042022.02-3vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.1vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.2vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.3vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.4vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.5vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.6vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.7vulnerable
Ubuntuedk224.042023.05-2vulnerable
Ubuntuedk224.042023.11-2vulnerable
Ubuntuedk224.042023.11-3vulnerable
Ubuntuedk224.042023.11-4vulnerable
Ubuntuedk224.042023.11-5vulnerable
Ubuntuedk224.042023.11-6vulnerable
Ubuntuedk224.042023.11-8vulnerable
Ubuntuedk224.042024.02-1vulnerable
Ubuntuedk224.042024.02-2vulnerable
Ubuntuedk224.042024.02-2ubuntu0.1vulnerable
Ubuntuedk224.042024.02-2ubuntu0.3vulnerable
Ubuntuedk224.042024.02-2ubuntu0.4vulnerable
Ubuntuedk224.042024.02-2ubuntu0.5vulnerable
Ubuntuedk224.042024.02-2ubuntu0.6vulnerable
Ubuntuedk224.042024.02-2ubuntu0.7vulnerable
Ubuntuedk224.042024.02-2ubuntu0.8vulnerable
Ubuntuedk224.042024.02-2ubuntu0.9vulnerable
Ubuntuedk224.042024.02-2ubuntu0.10vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianedk2sourcesid2024.05-1not yet assignedNot reported[1063727]
Debianedk2sourceforky2024.05-1not yet assignedNot reported[1063727]
Debianedk2sourcetrixie2024.05-1not yet assignedNot reported[1063727]
Debianedk2sourcebookworm(unfixed)not yet assignedNot reported[1063727]
Ubuntuedk2debnoble2024.02-2ubuntu0.6Not reportedNot reportedNot reported
Ubuntuefi-shell-aa64debnoble2024.02-2ubuntu0.6Not reportedNot reportedNot reported
Ubuntuefi-shell-armdebnoble2024.02-2ubuntu0.6Not reportedNot reportedNot reported
Ubuntuefi-shell-ia32debnoble2024.02-2ubuntu0.6Not reportedNot reportedNot reported
Ubuntuefi-shell-riscv64debnoble2024.02-2ubuntu0.6Not reportedNot reportedNot reported
Ubuntuefi-shell-x64debnoble2024.02-2ubuntu0.6Not reportedNot reportedNot reported
Ubuntuovmfdebnoble2024.02-2ubuntu0.6Not reportedNot reportedNot reported
Ubuntuovmf-ia32debnoble2024.02-2ubuntu0.6Not reportedNot reportedNot reported
Ubuntuqemu-efi-aarch64debnoble2024.02-2ubuntu0.6Not reportedNot reportedNot reported
Ubuntuqemu-efi-armdebnoble2024.02-2ubuntu0.6Not reportedNot reportedNot reported
Ubuntuqemu-efi-riscv64debnoble2024.02-2ubuntu0.6Not reportedNot reportedNot reported

[Debian bug #1063727]

Notes

[bookworm] edk2: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]