{"id":769,"date":"2025-06-19T14:05:32","date_gmt":"2025-06-19T18:05:32","guid":{"rendered":"https:\/\/ami2025dev.wpenginepowered.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/"},"modified":"2025-06-19T14:05:32","modified_gmt":"2025-06-19T18:05:32","slug":"eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution","status":"publish","type":"project","link":"https:\/\/www.ami.com\/resource\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/","title":{"rendered":"Eclypsium Examines OpenBMC Security Across Multiple Builds, Identifies MegaRAC OneTree as Optimal Solution"},"content":{"rendered":"

A new study published by infrastructure security specialists Eclypsium<\/a> investigates the security of various implementations of the Linux Foundation\u2019s open-source OpenBMC\u2122<\/a> firmware stack. The \u201cOpenBMC Security in Practice<\/a>\u201d report reviews its flexibility, widespread adoption and various complexities in managing vulnerabilities. The Eclypsium report also evaluates the handling of CVEs and patch practices from different vendors and ultimately identifies MegaRAC OneTree\u2122<\/a> from AMI as the optimal solution.<\/p>\n

To arrive at its results, Eclypsium took a snapshot of the latest available OpenBMC vendor releases from the main Open BMC GitHub repository, Intel\u00ae S2600WF, Dell\u2122 R670csp, Supermicro\u00ae X14DBG-AP and MegaRAC OneTree (version 2.0).\u00a0 They then recorded both the number of open CVEs for each code revision and the related areas where the security issue exists.<\/p>\n

While the results show a clear advantage for MegaRAC OneTree, readers should also take note that certain vulnerabilities discovered in the upstream OpenBMC code that were shown as CVEs affecting MegaRAC OneTree have already been mitigated by AMI. Additionally, we continue to apply mitigations directly to the downstream code in the form of updates distributed to customers that will be upstreamed in the next open-source revision. Consequently, the total number of CVEs that are open today is less than what the study from Eclypsium was able to capture.<\/p>\n

Eclypsium\u2019s report highlights the importance of leveraging a robust Software Bill of Materials (SBOM) approach with vulnerability management, regular updates, and transparency throughout the supply chain for maintaining a more secure supply chain.<\/p>\n

For more information on our MegaRAC OneTree OpenBMC-based solution with add-on technologies and enhancements, we invite you to download the datasheet<\/a> or contact us<\/a> to schedule a discussion today.<\/span><\/p>\n

OpenBMC is a trademark of LF Projects, LLC. MegaRAC is a registered trademark of AMI US Holdings, Inc., in the US and other countries. Intel is a registered trademark of Intel Corporation. Dell Technologies, Dell, and other trademarks are trademarks of Dell Inc. or its subsidiaries. Supermicro\u00ae is a registered trademark of Super Micro Computer, Inc. All other trademarks and registered trademarks are the property of their respective owners.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

A new study published by infrastructure security specialists Eclypsium investigates the security of various implementations of the Linux Foundation\u2019s open-source OpenBMC\u2122 firmware stack. The \u201cOpenBMC Security in Practice\u201d report reviews its flexibility, widespread adoption and various complexities in managing vulnerabilities. The Eclypsium report also evaluates the handling of CVEs and patch practices from different vendors […]<\/p>\n","protected":false},"author":8,"featured_media":770,"comment_status":"open","ping_status":"open","template":"","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","content-type":"","footnotes":""},"project_category":[1499],"project_tag":[1504,1561,1562,1546,1505,1511],"class_list":["post-769","project","type-project","status-publish","has-post-thumbnail","hentry","project_category-blog","project_tag-bmc-firmware","project_tag-bmc-security","project_tag-eclypsium","project_tag-firmware-security","project_tag-megarac-onetree","project_tag-openbmc","topics-megarac"],"yoast_head":"\nEclypsium Examines OpenBMC Security Across Multiple Builds, Identifies MegaRAC OneTree as Optimal Solution - AMI<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Eclypsium Examines OpenBMC Security Across Multiple Builds, Identifies MegaRAC OneTree as Optimal Solution\" \/>\n<meta property=\"og:description\" content=\"A new study published by infrastructure security specialists Eclypsium investigates the security of various implementations of the Linux Foundation\u2019s open-source OpenBMC\u2122 firmware stack. The \u201cOpenBMC Security in Practice\u201d report reviews its flexibility, widespread adoption and various complexities in managing vulnerabilities. The Eclypsium report also evaluates the handling of CVEs and patch practices from different vendors […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/\" \/>\n<meta property=\"og:site_name\" content=\"AMI\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/TheWorldRunsonAMI#\" \/>\n<meta property=\"article:published_time\" content=\"2025-06-19T18:05:32+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/06\/Eclypsium-open-bmc-security_1200x845.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"845\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"christinef\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@AMI_PR\" \/>\n<meta name=\"twitter:site\" content=\"@AMI_PR\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"christinef\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/\"},\"author\":{\"name\":\"christinef\",\"@id\":\"https:\/\/www.ami.com\/#\/schema\/person\/fc3dd8265a9f8efc4841dd8f9cf418b8\"},\"headline\":\"Eclypsium Examines OpenBMC Security Across Multiple Builds, Identifies MegaRAC OneTree as Optimal Solution\",\"datePublished\":\"2025-06-19T18:05:32+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/\"},\"wordCount\":358,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.ami.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/06\/Eclypsium-open-bmc-security_1200x845.jpg\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/\",\"url\":\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/\",\"name\":\"Eclypsium Examines OpenBMC Security Across Multiple Builds, Identifies MegaRAC OneTree as Optimal Solution - AMI\",\"isPartOf\":{\"@id\":\"https:\/\/www.ami.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/06\/Eclypsium-open-bmc-security_1200x845.jpg\",\"datePublished\":\"2025-06-19T18:05:32+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#primaryimage\",\"url\":\"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/06\/Eclypsium-open-bmc-security_1200x845.jpg\",\"contentUrl\":\"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/06\/Eclypsium-open-bmc-security_1200x845.jpg\",\"width\":1200,\"height\":845},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.ami.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Eclypsium Examines OpenBMC Security Across Multiple Builds, Identifies MegaRAC OneTree as Optimal Solution\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.ami.com\/#website\",\"url\":\"https:\/\/www.ami.com\/\",\"name\":\"AMI\",\"description\":\"Trusted Leader in UEFI, BMC & Open-Source Firmware\",\"publisher\":{\"@id\":\"https:\/\/www.ami.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.ami.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.ami.com\/#organization\",\"name\":\"AMI\",\"url\":\"https:\/\/www.ami.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.ami.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/09\/cropped-AMI-Favicon.png\",\"contentUrl\":\"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/09\/cropped-AMI-Favicon.png\",\"width\":512,\"height\":512,\"caption\":\"AMI\"},\"image\":{\"@id\":\"https:\/\/www.ami.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/TheWorldRunsonAMI#\",\"https:\/\/x.com\/AMI_PR\",\"https:\/\/www.linkedin.com\/company\/ami\",\"https:\/\/www.youtube.com\/c\/AMI_PR\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.ami.com\/#\/schema\/person\/fc3dd8265a9f8efc4841dd8f9cf418b8\",\"name\":\"christinef\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.ami.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/01f355d4a3cd8819e541466d7ac7a4b284dd638663bee12e7fd6f85f9ccb7ef3?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/01f355d4a3cd8819e541466d7ac7a4b284dd638663bee12e7fd6f85f9ccb7ef3?s=96&d=mm&r=g\",\"caption\":\"christinef\"},\"url\":\"https:\/\/www.ami.com\/author\/christinef\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Eclypsium Examines OpenBMC Security Across Multiple Builds, Identifies MegaRAC OneTree as Optimal Solution - AMI","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/","og_locale":"en_US","og_type":"article","og_title":"Eclypsium Examines OpenBMC Security Across Multiple Builds, Identifies MegaRAC OneTree as Optimal Solution","og_description":"A new study published by infrastructure security specialists Eclypsium investigates the security of various implementations of the Linux Foundation\u2019s open-source OpenBMC\u2122 firmware stack. The \u201cOpenBMC Security in Practice\u201d report reviews its flexibility, widespread adoption and various complexities in managing vulnerabilities. The Eclypsium report also evaluates the handling of CVEs and patch practices from different vendors […]","og_url":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/","og_site_name":"AMI","article_publisher":"https:\/\/www.facebook.com\/TheWorldRunsonAMI#","article_published_time":"2025-06-19T18:05:32+00:00","og_image":[{"width":1200,"height":845,"url":"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/06\/Eclypsium-open-bmc-security_1200x845.jpg","type":"image\/jpeg"}],"author":"christinef","twitter_card":"summary_large_image","twitter_creator":"@AMI_PR","twitter_site":"@AMI_PR","twitter_misc":{"Written by":"christinef","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#article","isPartOf":{"@id":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/"},"author":{"name":"christinef","@id":"https:\/\/www.ami.com\/#\/schema\/person\/fc3dd8265a9f8efc4841dd8f9cf418b8"},"headline":"Eclypsium Examines OpenBMC Security Across Multiple Builds, Identifies MegaRAC OneTree as Optimal Solution","datePublished":"2025-06-19T18:05:32+00:00","mainEntityOfPage":{"@id":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/"},"wordCount":358,"commentCount":0,"publisher":{"@id":"https:\/\/www.ami.com\/#organization"},"image":{"@id":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#primaryimage"},"thumbnailUrl":"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/06\/Eclypsium-open-bmc-security_1200x845.jpg","inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/","url":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/","name":"Eclypsium Examines OpenBMC Security Across Multiple Builds, Identifies MegaRAC OneTree as Optimal Solution - AMI","isPartOf":{"@id":"https:\/\/www.ami.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#primaryimage"},"image":{"@id":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#primaryimage"},"thumbnailUrl":"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/06\/Eclypsium-open-bmc-security_1200x845.jpg","datePublished":"2025-06-19T18:05:32+00:00","breadcrumb":{"@id":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#primaryimage","url":"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/06\/Eclypsium-open-bmc-security_1200x845.jpg","contentUrl":"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/06\/Eclypsium-open-bmc-security_1200x845.jpg","width":1200,"height":845},{"@type":"BreadcrumbList","@id":"https:\/\/www.ami.com\/eclypsium-examines-openbmc-security-across-multiple-builds-identifies-megarac-onetree-as-optimal-solution\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.ami.com\/"},{"@type":"ListItem","position":2,"name":"Eclypsium Examines OpenBMC Security Across Multiple Builds, Identifies MegaRAC OneTree as Optimal Solution"}]},{"@type":"WebSite","@id":"https:\/\/www.ami.com\/#website","url":"https:\/\/www.ami.com\/","name":"AMI","description":"Trusted Leader in UEFI, BMC & Open-Source Firmware","publisher":{"@id":"https:\/\/www.ami.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.ami.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.ami.com\/#organization","name":"AMI","url":"https:\/\/www.ami.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.ami.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/09\/cropped-AMI-Favicon.png","contentUrl":"https:\/\/www.ami.com\/wp-content\/uploads\/2025\/09\/cropped-AMI-Favicon.png","width":512,"height":512,"caption":"AMI"},"image":{"@id":"https:\/\/www.ami.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/TheWorldRunsonAMI#","https:\/\/x.com\/AMI_PR","https:\/\/www.linkedin.com\/company\/ami","https:\/\/www.youtube.com\/c\/AMI_PR"]},{"@type":"Person","@id":"https:\/\/www.ami.com\/#\/schema\/person\/fc3dd8265a9f8efc4841dd8f9cf418b8","name":"christinef","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.ami.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/01f355d4a3cd8819e541466d7ac7a4b284dd638663bee12e7fd6f85f9ccb7ef3?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/01f355d4a3cd8819e541466d7ac7a4b284dd638663bee12e7fd6f85f9ccb7ef3?s=96&d=mm&r=g","caption":"christinef"},"url":"https:\/\/www.ami.com\/author\/christinef\/"}]}},"_links":{"self":[{"href":"https:\/\/www.ami.com\/wp-json\/wp\/v2\/project\/769","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ami.com\/wp-json\/wp\/v2\/project"}],"about":[{"href":"https:\/\/www.ami.com\/wp-json\/wp\/v2\/types\/project"}],"author":[{"embeddable":true,"href":"https:\/\/www.ami.com\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ami.com\/wp-json\/wp\/v2\/comments?post=769"}],"version-history":[{"count":0,"href":"https:\/\/www.ami.com\/wp-json\/wp\/v2\/project\/769\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ami.com\/wp-json\/wp\/v2\/media\/770"}],"wp:attachment":[{"href":"https:\/\/www.ami.com\/wp-json\/wp\/v2\/media?parent=769"}],"wp:term":[{"taxonomy":"project_category","embeddable":true,"href":"https:\/\/www.ami.com\/wp-json\/wp\/v2\/project_category?post=769"},{"taxonomy":"project_tag","embeddable":true,"href":"https:\/\/www.ami.com\/wp-json\/wp\/v2\/project_tag?post=769"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}