CVE-2021-20271

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

The RPM Package Manager (RPM) is a powerful package management system capability as below -building computer software from source into easily distributable packages -installing, updating and uninstalling packaged software -querying detailed information about the packaged software, whether installed or not -verifying integrity of packaged software and resulting software installation

Security Fix(es):

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.(CVE-2021-20271)

The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

Security Fix(es):

• rpm: Signature checks bypass via corrupted rpm package (CVE-2021-20271)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

This update from 4.16.1.2 to 4.16.1.3 fixes bugs several bugs the RPM package manager, including several security issues:

• Fix arbitrary data copied from signature header past signature checking (CVE-2021-3421)
• Fix signature check bypass with corrupted package (CVE-2021-20271)
• Fix missing bounds checks in headerImport() and headerCheck() (CVE-2021-20266)
• Fix missing sanity checks on header entry count and region data overlap
• Fix access past end of header if the last entry is string type
• Fix unsafe headerCopyLoad() still used in codebase

This update for rpm fixes the following issues:

Security issues fixed:

• CVE-2021-3421, CVE-2021-20271, CVE-2021-20266: Multiple header check improvements (bsc#1183543, bsc#1183545, bsc#1183632)
• PGP hardening changes (bsc#1185299)
• Fixed potential access of freed mem in ndb's glue code (bsc#1179416)

Maintaince issues fixed:

• Fixed zstd detection (bsc#1187670)
• Added ndb rofs support (bsc#1188548)
• Fixed deadlock when multiple rpm processes try tp acquire the database lock (bsc#1183659)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for rpm fixes the following issues:

• Changed default package verification level to 'none' to be compatible to rpm-4.14.1
• Made illegal obsoletes a warning
• Fixed a potential access of freed mem in ndb's glue code (bsc#1179416)
• Added support for enforcing signature policy and payload verification step to transactions (jsc#SLE-17817)
• Added :humansi and :hmaniec query formatters for human readable output
• Added query selectors for whatobsoletes and whatconflicts
• Added support for sorting caret higher than base version
• rpm does no longer require the signature header to be in a contiguous region when signing (bsc#1181805)

Security fixes:

• CVE-2021-3421: A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity (bsc#1183543)

• CVE-2021-20271: A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability (bsc#1183545)

• CVE-2021-20266: A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.

This update for libdnf fixes the following issues:

• Fixed crash when loading DVD repositories

Update to 0.62.0

• Change order of TransactionItemReason (rh#1921063)
• Add two new comperators for security filters (rh#1918475)
• Apply security filters for candidates with lower priority
• Fix: Goal - translation of messages in global maps
• Enhance description of modular solvables
• Improve performance for module query
• Change mechanism of modular errata applicability (rh#1804234)
• dnf_transaction_commit(): Remove second call to rpmtsSetVSFlags
• Fix a couple of memory leaks
• Fix: Setting of librepo handle in newHandle function
• Remove failsafe data when module is not enabled (rh#1847035)
• Expose librepo's checksum functions via SWIG
• Fix: Mising check of 'hy_split_nevra()' return code
• Do not allow 1 as installonly_limit value (rh#1926261)
• Fix check whether the subkey can be used for signing
• Hardening: add signature check with rpmcliVerifySignatures (CVE-2021-3445, CVE-2021-3421, CVE-2021-20271, rh#1932079, rh#1932089, rh#1932090, bsc#1183779)
• Add a config option sslverifystatus, defaults to false (rh#1814383)
• [context] Add API for distro-sync

• Fix dependency for repo-config-zypp subpackage to work with SLE

Update to 0.60.0

• Fix repo.fresh() implementation
• Fix: Fully set ssl in newHandle function
• [conf] Add options for working with certificates used with proxy
• Apply proxy certificate options
• lock: Switch return-if-fail to assert to quiet gcc -fanalyzer
• build-sys: Clean up message about Python bindings
• Modify module NSVCA parsing - context definition (rh#1926771)
• [context] Fix: dnf_package_is_installonly (rh#1928056)
• Fix problematic language
• Add getApplicablePackages to advisory and isApplicable to advisorymodule
• Keep isAdvisoryApplicable to preserve API
• Run ModulePackageContainerTest tests in tmpdir, merge interdependent
• [context] Support config file option 'proxy_auth_method', defaults 'any'
• Properly handle multiple collections in updateinfo.xml (rh#1804234)
• Support main config file option 'installonlypkgs'
• Support main config file option 'protected_packages'

• Add repo-config-zypp subpackage to allow easily using Zypper repository configuration

• Backport support for using certificates for repository authorization

• Backport another fix for adding controls to installonlypkgs

• Add patch to move directory for dnf state data to /usr/lib/sysimage

• Backport fixes to add controls for installonlypkgs and protected_packages

Update to version 0.58.0

• Option: Add reset() method
• Add OptionBinds::getOption() method
• [context] Add dnf_repo_conf_from_gkeyfile() and dnf_repo_conf_reset()
• [context] Add support for options: minrate, throttle, bandwidth, timeout
• [context] Remove g_key_file_get_string() from dnf_repo_set_keyfile_data()
• Allow loading ext metadata even if only cache (solv) is present
• Add ASAN_OPTIONS for test_libdnf_main
• [context,API] Functions for accessing main/global configuration options
• [context,API] Function for adding setopt
• Add getter for modular obsoletes from ModuleMetadata
• Add ModulePackage.getStaticContext() and getRequires()
• Add compatible layer for MdDocuments v2
• Fix modular queries with the new solver
• Improve formatting of error string for modules
• Change mechanism of module conflicts
• Fix load/update FailSafe

Update to version 0.55.2

• Improve performance of query installed() and available()
• Swdb: Add a method to get the current transaction
• [modules] Add special handling for src artifacts (rh#1809314)
• Better msgs if 'basecachedir' or 'proxy_password' isn't set (rh#1888946)
• Add new options module_stream_switch
• Support allow_vendor_change setting in dnf context API

Update to version 0.55.0

• Add vendor to dnf API (rh#1876561)
• Add formatting function for solver error
• Add error types in ModulePackageContainer
• Implement module enable for context part
• Improve string formatting for translation
• Remove…

This update for rpm fixes the following issues:

• Changed default package verification level to 'none' to be compatible to rpm-4.14.1
• Made illegal obsoletes a warning
• Fixed a potential access of freed mem in ndb's glue code (bsc#1179416)
• Added support for enforcing signature policy and payload verification step to transactions (jsc#SLE-17817)
• Added :humansi and :hmaniec query formatters for human readable output
• Added query selectors for whatobsoletes and whatconflicts
• Added support for sorting caret higher than base version
• rpm does no longer require the signature header to be in a contiguous region when signing (bsc#1181805)

Security fixes:

• CVE-2021-3421: A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity (bsc#1183543)

• CVE-2021-20271: A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability (bsc#1183545)

• CVE-2021-20266: A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.

This update for rpm fixes the following issues:

Security issues fixed:

• CVE-2021-3421, CVE-2021-20271, CVE-2021-20266: Multiple header check improvements (bsc#1183543, bsc#1183545, bsc#1183632)
• PGP hardening changes (bsc#1185299)
• Fixed potential access of freed mem in ndb's glue code (bsc#1179416)

Maintaince issues fixed:

• Fixed zstd detection (bsc#1187670)
• Added ndb rofs support (bsc#1188548)
• Fixed deadlock when multiple rpm processes try tp acquire the database lock (bsc#1183659)

This update for rpm fixes the following issues:

• Fixed PGP parsing bugs (bsc#1185299).
• Fixed various format handling bugs (bsc#996280).
• CVE-2021-3421: Fixed vulnerability where unsigned headers could be injected into the rpm database (bsc#1183543).
• CVE-2021-20271: Fixed vulnerability where a corrupted rpm could corrupt the rpm database (bsc#1183545).
• CVE-2021-20266: Fixed missing bounds check in hdrblobInit (bsc#1183632).

Bugfixes:

• Fixed deadlock when multiple rpm processes tried to acquire the database lock (bsc#1183659).

Demi M. Obenour discovered that RPM Package Manager incorrectly handled certain files. An attacker could possibly use this issue to corrupt the database and cause a denial of service. (CVE-2021-3421, CVE-2021-20271)

Demi M. Obenour discovered that RPM Package Manager incorrectly handled memory when processing certain data from the database. An attacker could possibly use this issue to cause a denial of service. This issue only affects Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-20266)