There are 4 open security issues in bullseye.
4 issues left for the package maintainer to handle:
- CVE-2019-14560:
(needs triaging)
- CVE-2021-28213:
(needs triaging)
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.
- CVE-2021-28216:
(needs triaging)
BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.
- CVE-2021-38575:
(needs triaging)
You can find information about how to handle these issues in the security team's documentation.
1 issue that should be fixed with the next stable update:
- CVE-2019-11098:
Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/e/edk2.png){kind=link}