CVE-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

The RPM Package Manager (RPM) is a powerful package management system capability as below

Security Fix(es):

The OpenPGP subkey is associated with the master key through a binding signature. RPM will not check their binding signature before importing the subkey; if the attacker can add it or the other party of social engineering adds the malicious subkey to the legal public Key, RPM may mistakenly trust malicious signatures.(CVE-2021-3521)

The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

Security Fix(es):

• rpm: RPM does not require subkeys to have a valid binding signature (CVE-2021-3521)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

Security Fix(es):

• rpm: RPM does not require subkeys to have a valid binding signature (CVE-2021-3521)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2021-3521: RPM does not require subkeys to have a valid binding signature

• CVE-2021-20266: missing length checks in hdrblobInit()
• CVE-2021-3521: RPM does not require subkeys to have a valid binding signature
• Address important covscan issues (#1996665, #2022537)

• CVE-2021-3521: validate and require subkey binding signatures on PGP public keys

• CVE-2021-3521: validate and require subkey binding signatures on PGP public keys

• CVE-2021-3521: validate and require subkey binding signatures on PGP public keys

RPM does not require subkeys to have a valid binding signature (CVE-2021-3521)

These are all security issues fixed in the librpmbuild9-4.17.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rpm fixes the following issues:

Security fixes:

• CVE-2021-3521: Fixed missing subkey binding signature checking (bsc#1191175)

Other fixes:

• accept more signature subpackets marked as critical (bsc#1218686)
• backport limit support for the autopatch macro (bsc#1189495)

This update for rpm fixes the following issues:

Security fixes:

• CVE-2021-3521: Fixed missing subkey binding signature checking (bsc#1191175)

Other fixes:

• accept more signature subpackets marked as critical (bsc#1218686)
• backport limit support for the autopatch macro (bsc#1189495)

This update for rpm fixes the following issues:

Security fixes:

• CVE-2021-3521: Fixed missing subkey binding signature checking (bsc#1191175)

Other fixes:

• accept more signature subpackets marked as critical (bsc#1218686)
• backport limit support for the autopatch macro (bsc#1189495)