CVE-2020-10759

A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. The highest threat from this vulnerability is to confidentiality and integrity.

• CWE-347
• CWE-347

• https://bugzilla.redhat.com/show_bug.cgi?id=1844316Issue Tracking, Third Party Advisory
• https://github.com/justinsteven/advisories/blob/master/2020_fwupd_dangling_s3_bucket_and_CVE-2020-10759_signature_verification_bypass.mdExploit, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1844316Issue Tracking, Third Party Advisory
• https://github.com/justinsteven/advisories/blob/master/2020_fwupd_dangling_s3_bucket_and_CVE-2020-10759_signature_verification_bypass.mdExploit, Third Party Advisory

Published

Sep 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10753A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph O…6.5
• CVE-2020-10754It was found that nmcli, a command line interface to Network…4.3
• CVE-2020-10755An insecure-credentials flaw was found in all openstack-cind…6.5
• CVE-2020-10756An out-of-bounds read vulnerability was found in the SLiRP n…6.5
• CVE-2020-10757A flaw was found in the Linux Kernel in versions after 4.5-r…7.8
• CVE-2020-10758A vulnerability was found in Keycloak before 11.0.1 where Do…7.5
• CVE-2020-1076A denial of service vulnerability exists when Windows improp…5.5
• CVE-2020-10760A use-after-free flaw was found in all samba LDAP server ver…6.5
• CVE-2020-10761An assertion failure issue was found in the Network Block De…5
• CVE-2020-10762An information-disclosure flaw was found in the way that glu…5.5
• CVE-2020-10763An information-disclosure flaw was found in the way Heketi b…5.5
• CVE-2020-10764Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…