relax-and-recover vulnerabilities and fixes

Recent CVEs affecting relax-and-recover, with upgrade or downgrade steps. 1 tracked.

Also searched as: relax and recover.

relax-and-recover has 1 tracked vulnerability, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2024-01-12. Highest priority: CVE-2024-23301 (score 35/100).

• CVE-2024-23301 MEDIUM 5.5 UPGRADE MITIGATE Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y

FAQ

How do I fix relax-and-recover vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is relax-and-recover being exploited right now?

None of the tracked relax-and-recover CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which relax-and-recover CVE should I patch first?

CVE-2024-23301 currently ranks highest (35/100): Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y.

← Back to latest CVEs