Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia 8: 2021-0167 Moderate: RPM Signature Bypass and Bug Fix

mageia
Calendar Grey April 2, 2021
Dist Mageia Esm H88
Critical patch for Mageia addresses various rpm weaknesses in version 4.16.1.3. Enhance package reliability and protection.
This update from 4.16.1.2 to 4.16.1.3 fixes bugs several bugs the RPM package manager, including several security issues: * Fix arbitrary data copied from signature header past sig...

Summary

This update from 4.16.1.2 to 4.16.1.3 fixes bugs several bugs the RPM package manager, including several security issues: * Fix arbitrary data copied from signature header past signature checking (CVE-2021-3421) * Fix signature check bypass with corrupted package (CVE-2021-20271) * Fix missing bounds checks in headerImport() and headerCheck() (CVE-2021-20266) * Fix missing sanity checks on header entry count and region data overlap * Fix access past end of header if the last entry is string type * Fix unsafe headerCopyLoad() still used in codebase

References

- https://bugs.mageia.org/show_bug.cgi?id=28674

- https://rpm.org/wiki/Releases/4.16.1.3

- https://www.cve.org/CVERecord?id=CVE-2021-3421

- https://www.cve.org/CVERecord?id=CVE-2021-20266

- https://www.cve.org/CVERecord?id=CVE-2021-20271

Topics%20covered

Topics Covered

security advisory software update bug fix moderate severity RPM signature bypass Mageia

Resolution

SRPMS

- 8/core/rpm-4.16.1.3-1.mga8

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 02 Apr 2021
URL: https://advisories.mageia.org/MGASA-2021-0167.html
Type: security
CVE: CVE-2021-3421, CVE-2021-20266, CVE-2021-20271

Topics%20covered

Topics Covered

security advisory software update bug fix moderate severity RPM signature bypass Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here