CVE-2020-10759 PoC — fwupd 数据伪造问题漏洞

Source

https://github.com/justinsteven/CVE-2020-10759-poc

Associated Vulnerability

Title:fwupd 数据伪造问题漏洞 (CVE-2020-10759)
Description:A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. The highest threat from this vulnerability is to confidentiality and integrity.

Description

Proof of Concept for CVE-2020-10759 (fwupd signature validation bypass)

Readme

# Summary

Exploits CVE-2020-10759 - `fwupd` PGP signature verification bypass. See
<https://github.com/justinsteven/advisories/blob/master/2020_fwupd_dangling_s3_bucket_and_CVE-2020-10759_signature_verification_bypass.md>
for more details.

# Requirements

Note: You need to install `python3-gpg` from your OS vendor. This module
doesn't like being installed via `pip` because it needs to match your system's
installation of `libgpgme`.

```
apt install python3-flask python3-gpg python3-lxml
```

File Snapshot


 [4.0K]  /data/pocs/fa1a764c04225fc2cfea9031a18859fda789b8cd
├── [ 498]  README.md
└── [ 13K]  serve.py

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!