CVE-2020-15705

Key facts

CVSS score

6.4 (v3.1)

Severity

MEDIUM

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness (CWE)

CWE-347

EPSS score

1.4% (72th percentile)

In CISA KEV

No

In EU EUVD

Yes (EUVD-2020-7691)

Published

July 29, 2020

NVD last modified

June 17, 2026

Status

Modified

Affected products

• canonical / ubuntu linux
• canonical / ubuntu linux
• canonical / ubuntu linux
• canonical / ubuntu linux
• debian / debian linux
• gnu / grub2
• microsoft / windows 10
• microsoft / windows 10
• microsoft / windows 10
• microsoft / windows 10
• microsoft / windows 10
• microsoft / windows 10
• microsoft / windows 10
• microsoft / windows 10
• microsoft / windows 8.1
• microsoft / windows rt 8.1
• microsoft / windows server 2012
• microsoft / windows server 2012
• microsoft / windows server 2016
• microsoft / windows server 2016
• microsoft / windows server 2016
• microsoft / windows server 2016
• microsoft / windows server 2019
• opensuse / leap
• opensuse / leap
• redhat / enterprise linux
• redhat / enterprise linux
• redhat / enterprise linux atomic host
• redhat / openshift container platform
• suse / suse linux enterprise server
• suse / suse linux enterprise server
• suse / suse linux enterprise server

Certified products that may be affected

29 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

• Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat, Inc. - FIPS 140 5513 - active
• Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, LLC - FIPS 140 5461 - active
• Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5089 - active
• SUSE Linux Enterprise Server Version 15 SP2 - SUSE LLC - Common Criteria BSI-DSZ-CC-1168-2021 - active
• Red Hat Enterprise Linux 8 OpenSSL Cryptographic Module - Red Hat®, Inc. - FIPS 140 4642 - historical

See all 29 in the Security Certifications Explorer.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00067.html(Mailing List, Third Party Advisory)
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00069.html(Mailing List, Third Party Advisory)
• http://ubuntu.com/security/notices/USN-4432-1(Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2020/07/29/3(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2021/03/02/3(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2021/09/17/2(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2021/09/17/4(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2021/09/21/1(Mailing List, Third Party Advisory)
• https://access.redhat.com/security/vulnerabilities/grub2bootloader(Third Party Advisory)
• https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html(Issue Tracking, Vendor Advisory)
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011(Patch, Third Party Advisory, Vendor Advisory)
• https://security.gentoo.org/glsa/202104-05(Third Party Advisory)
• https://security.netapp.com/advisory/ntap-20200731-0008/(Third Party Advisory)
• https://usn.ubuntu.com/4432-1/(Third Party Advisory)
• https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass(Third Party Advisory)
• https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot(Third Party Advisory)
• https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/(Third Party Advisory)
• https://www.openwall.com/lists/oss-security/2020/07/29/3(Mailing List, Third Party Advisory)
• https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/(Third Party Advisory)
• https://www.suse.com/support/kb/doc/?id=000019673(Third Party Advisory)