CVE-2021-3445

A Library providing simplified C and Python API to libsolv.

Security Fix(es):

A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2021-3445)

dnf is a package manager that allows users to manage packages on their systems. It supports RPMs, modules and comps groups & environments.

Security Fix(es):

• libdnf: Signature verification bypass via signature placed in the main RPM header (CVE-2021-3445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.

dnf is a package manager that allows users to manage packages on their systems. It supports RPMs, modules and comps groups & environments.

Security Fix(es):

• libdnf: Signature verification bypass via signature placed in the main RPM header (CVE-2021-3445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2021-3445: fix signature verification bypass leading to code execution (RhBug:1932079)

• CVE-2021-3445: fix signature verification bypass leading to code execution (RhBug:1932079)

• CVE-2021-3445: fix signature verification bypass via signature placed in the main RPM header

This update for libdnf fixes the following issues:

• Fixed crash when loading DVD repositories

Update to 0.62.0

• Change order of TransactionItemReason (rh#1921063)
• Add two new comperators for security filters (rh#1918475)
• Apply security filters for candidates with lower priority
• Fix: Goal - translation of messages in global maps
• Enhance description of modular solvables
• Improve performance for module query
• Change mechanism of modular errata applicability (rh#1804234)
• dnf_transaction_commit(): Remove second call to rpmtsSetVSFlags
• Fix a couple of memory leaks
• Fix: Setting of librepo handle in newHandle function
• Remove failsafe data when module is not enabled (rh#1847035)
• Expose librepo's checksum functions via SWIG
• Fix: Mising check of 'hy_split_nevra()' return code
• Do not allow 1 as installonly_limit value (rh#1926261)
• Fix check whether the subkey can be used for signing
• Hardening: add signature check with rpmcliVerifySignatures (CVE-2021-3445, CVE-2021-3421, CVE-2021-20271, rh#1932079, rh#1932089, rh#1932090, bsc#1183779)
• Add a config option sslverifystatus, defaults to false (rh#1814383)
• [context] Add API for distro-sync

• Fix dependency for repo-config-zypp subpackage to work with SLE

Update to 0.60.0

• Fix repo.fresh() implementation
• Fix: Fully set ssl in newHandle function
• [conf] Add options for working with certificates used with proxy
• Apply proxy certificate options
• lock: Switch return-if-fail to assert to quiet gcc -fanalyzer
• build-sys: Clean up message about Python bindings
• Modify module NSVCA parsing - context definition (rh#1926771)
• [context] Fix: dnf_package_is_installonly (rh#1928056)
• Fix problematic language
• Add getApplicablePackages to advisory and isApplicable to advisorymodule
• Keep isAdvisoryApplicable to preserve API
• Run ModulePackageContainerTest tests in tmpdir, merge interdependent
• [context] Support config file option 'proxy_auth_method', defaults 'any'
• Properly handle multiple collections in updateinfo.xml (rh#1804234)
• Support main config file option 'installonlypkgs'
• Support main config file option 'protected_packages'

• Add repo-config-zypp subpackage to allow easily using Zypper repository configuration

• Backport support for using certificates for repository authorization

• Backport another fix for adding controls to installonlypkgs

• Add patch to move directory for dnf state data to /usr/lib/sysimage

• Backport fixes to add controls for installonlypkgs and protected_packages

Update to version 0.58.0

• Option: Add reset() method
• Add OptionBinds::getOption() method
• [context] Add dnf_repo_conf_from_gkeyfile() and dnf_repo_conf_reset()
• [context] Add support for options: minrate, throttle, bandwidth, timeout
• [context] Remove g_key_file_get_string() from dnf_repo_set_keyfile_data()
• Allow loading ext metadata even if only cache (solv) is present
• Add ASAN_OPTIONS for test_libdnf_main
• [context,API] Functions for accessing main/global configuration options
• [context,API] Function for adding setopt
• Add getter for modular obsoletes from ModuleMetadata
• Add ModulePackage.getStaticContext() and getRequires()
• Add compatible layer for MdDocuments v2
• Fix modular queries with the new solver
• Improve formatting of error string for modules
• Change mechanism of module conflicts
• Fix load/update FailSafe

Update to version 0.55.2

• Improve performance of query installed() and available()
• Swdb: Add a method to get the current transaction
• [modules] Add special handling for src artifacts (rh#1809314)
• Better msgs if 'basecachedir' or 'proxy_password' isn't set (rh#1888946)
• Add new options module_stream_switch
• Support allow_vendor_change setting in dnf context API

Update to version 0.55.0

• Add vendor to dnf API (rh#1876561)
• Add formatting function for solver error
• Add error types in ModulePackageContainer
• Implement module enable for context part
• Improve string formatting for translation
• Remove…

These are all security issues fixed in the hawkey-man-0.63.1-1.2 package on the GA media of openSUSE Tumbleweed.