<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for grub2</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2020:2308-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2020-08-25T12:49:05Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2020-08-25T12:49:05Z</InitialReleaseDate>
    <CurrentReleaseDate>2020-08-25T12:49:05Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for grub2</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for grub2 fixes the following issues:

- CVE-2020-15705: Fail kernel validation without shim protocol (bsc#1174421).
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-2020-2308,SUSE-OpenStack-Cloud-7-2020-2308,SUSE-SLE-SAP-12-SP2-2020-2308,SUSE-SLE-SERVER-12-SP2-2020-2308,SUSE-SLE-SERVER-12-SP2-BCL-2020-2308</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20202308-1/</URL>
      <Description>Link for SUSE-SU-2020:2308-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2020-August/007292.html</URL>
      <Description>E-Mail link for SUSE-SU-2020:2308-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1174421</URL>
      <Description>SUSE Bug 1174421</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-15705/</URL>
      <Description>SUSE CVE CVE-2020-15705 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP2-BCL">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP2-BCL">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL" CPE="cpe:/o:suse:sles-bcl:12:sp2">SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP2-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS" CPE="cpe:/o:suse:sles-ltss:12:sp2">SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2" CPE="cpe:/o:suse:sles_sap:12:sp2">SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud 7">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud 7">
        <FullProductName ProductID="SUSE OpenStack Cloud 7" CPE="cpe:/o:suse:suse-openstack-cloud:7">SUSE OpenStack Cloud 7</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="grub2-2.02~beta2-115.56.1">
      <FullProductName ProductID="grub2-2.02~beta2-115.56.1">grub2-2.02~beta2-115.56.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="grub2-arm64-efi-2.02~beta2-115.56.1">
      <FullProductName ProductID="grub2-arm64-efi-2.02~beta2-115.56.1">grub2-arm64-efi-2.02~beta2-115.56.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="grub2-branding-upstream-2.02~beta2-115.56.1">
      <FullProductName ProductID="grub2-branding-upstream-2.02~beta2-115.56.1">grub2-branding-upstream-2.02~beta2-115.56.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="grub2-i386-efi-2.02~beta2-115.56.1">
      <FullProductName ProductID="grub2-i386-efi-2.02~beta2-115.56.1">grub2-i386-efi-2.02~beta2-115.56.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="grub2-i386-pc-2.02~beta2-115.56.1">
      <FullProductName ProductID="grub2-i386-pc-2.02~beta2-115.56.1">grub2-i386-pc-2.02~beta2-115.56.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="grub2-powerpc-ieee1275-2.02~beta2-115.56.1">
      <FullProductName ProductID="grub2-powerpc-ieee1275-2.02~beta2-115.56.1">grub2-powerpc-ieee1275-2.02~beta2-115.56.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="grub2-s390x-emu-2.02~beta2-115.56.1">
      <FullProductName ProductID="grub2-s390x-emu-2.02~beta2-115.56.1">grub2-s390x-emu-2.02~beta2-115.56.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="grub2-snapper-plugin-2.02~beta2-115.56.1">
      <FullProductName ProductID="grub2-snapper-plugin-2.02~beta2-115.56.1">grub2-snapper-plugin-2.02~beta2-115.56.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="grub2-systemd-sleep-plugin-2.02~beta2-115.56.1">
      <FullProductName ProductID="grub2-systemd-sleep-plugin-2.02~beta2-115.56.1">grub2-systemd-sleep-plugin-2.02~beta2-115.56.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="grub2-x86_64-efi-2.02~beta2-115.56.1">
      <FullProductName ProductID="grub2-x86_64-efi-2.02~beta2-115.56.1">grub2-x86_64-efi-2.02~beta2-115.56.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="grub2-x86_64-xen-2.02~beta2-115.56.1">
      <FullProductName ProductID="grub2-x86_64-xen-2.02~beta2-115.56.1">grub2-x86_64-xen-2.02~beta2-115.56.1</FullProductName>
    </Branch>
    <Relationship ProductReference="grub2-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:grub2-2.02~beta2-115.56.1">grub2-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-i386-pc-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:grub2-i386-pc-2.02~beta2-115.56.1">grub2-i386-pc-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-snapper-plugin-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:grub2-snapper-plugin-2.02~beta2-115.56.1">grub2-snapper-plugin-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-systemd-sleep-plugin-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:grub2-systemd-sleep-plugin-2.02~beta2-115.56.1">grub2-systemd-sleep-plugin-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-x86_64-efi-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:grub2-x86_64-efi-2.02~beta2-115.56.1">grub2-x86_64-efi-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-x86_64-xen-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:grub2-x86_64-xen-2.02~beta2-115.56.1">grub2-x86_64-xen-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-2.02~beta2-115.56.1">grub2-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-i386-pc-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-i386-pc-2.02~beta2-115.56.1">grub2-i386-pc-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-powerpc-ieee1275-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-powerpc-ieee1275-2.02~beta2-115.56.1">grub2-powerpc-ieee1275-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-s390x-emu-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-s390x-emu-2.02~beta2-115.56.1">grub2-s390x-emu-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-snapper-plugin-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-snapper-plugin-2.02~beta2-115.56.1">grub2-snapper-plugin-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-systemd-sleep-plugin-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-systemd-sleep-plugin-2.02~beta2-115.56.1">grub2-systemd-sleep-plugin-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-x86_64-efi-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-x86_64-efi-2.02~beta2-115.56.1">grub2-x86_64-efi-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-x86_64-xen-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-x86_64-xen-2.02~beta2-115.56.1">grub2-x86_64-xen-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-2.02~beta2-115.56.1">grub2-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-i386-pc-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-i386-pc-2.02~beta2-115.56.1">grub2-i386-pc-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-powerpc-ieee1275-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-powerpc-ieee1275-2.02~beta2-115.56.1">grub2-powerpc-ieee1275-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-snapper-plugin-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-snapper-plugin-2.02~beta2-115.56.1">grub2-snapper-plugin-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-systemd-sleep-plugin-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-systemd-sleep-plugin-2.02~beta2-115.56.1">grub2-systemd-sleep-plugin-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-x86_64-efi-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-x86_64-efi-2.02~beta2-115.56.1">grub2-x86_64-efi-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-x86_64-xen-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-x86_64-xen-2.02~beta2-115.56.1">grub2-x86_64-xen-2.02~beta2-115.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:grub2-2.02~beta2-115.56.1">grub2-2.02~beta2-115.56.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-i386-pc-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:grub2-i386-pc-2.02~beta2-115.56.1">grub2-i386-pc-2.02~beta2-115.56.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-s390x-emu-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:grub2-s390x-emu-2.02~beta2-115.56.1">grub2-s390x-emu-2.02~beta2-115.56.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-snapper-plugin-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:grub2-snapper-plugin-2.02~beta2-115.56.1">grub2-snapper-plugin-2.02~beta2-115.56.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-systemd-sleep-plugin-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:grub2-systemd-sleep-plugin-2.02~beta2-115.56.1">grub2-systemd-sleep-plugin-2.02~beta2-115.56.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-x86_64-efi-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:grub2-x86_64-efi-2.02~beta2-115.56.1">grub2-x86_64-efi-2.02~beta2-115.56.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
    <Relationship ProductReference="grub2-x86_64-xen-2.02~beta2-115.56.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 7">
      <FullProductName ProductID="SUSE OpenStack Cloud 7:grub2-x86_64-xen-2.02~beta2-115.56.1">grub2-x86_64-xen-2.02~beta2-115.56.1 as a component of SUSE OpenStack Cloud 7</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.</Note>
    </Notes>
    <CVE>CVE-2020-15705</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:grub2-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:grub2-i386-pc-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:grub2-snapper-plugin-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:grub2-systemd-sleep-plugin-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:grub2-x86_64-efi-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:grub2-x86_64-xen-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-i386-pc-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-powerpc-ieee1275-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-s390x-emu-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-snapper-plugin-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-systemd-sleep-plugin-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-x86_64-efi-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-LTSS:grub2-x86_64-xen-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-i386-pc-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-powerpc-ieee1275-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-snapper-plugin-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-systemd-sleep-plugin-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-x86_64-efi-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP2:grub2-x86_64-xen-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:grub2-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:grub2-i386-pc-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:grub2-s390x-emu-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:grub2-snapper-plugin-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:grub2-systemd-sleep-plugin-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:grub2-x86_64-efi-2.02~beta2-115.56.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 7:grub2-x86_64-xen-2.02~beta2-115.56.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.4</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20202308-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-15705.html</URL>
        <Description>CVE-2020-15705</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1174421</URL>
        <Description>SUSE Bug 1174421</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1182890</URL>
        <Description>SUSE Bug 1182890</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
