Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
98
security advisorymoderate severityRed Hat EnterpriseRed Hat Enterprise Linux 8 RHSA-2021-4464-02 Moderate: dnf Signature Bypass
An update for dnf, dnf-plugins-core, and libdnf is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: dnf security and bug fix update Advisory ID: RHSA-2021:4464-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4464 Issue date: 2021-11-09 CVE Names: CVE-2021-3445 ==================================================================== 1. Summary: An update for dnf, dnf-plugins-core, and libdnf is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 Red Hat Enterprise Linux CRB (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: dnf is a package manager that allows users to manage packages on their systems. It supports RPMs, modules and comps groups & environments. Security Fix(es): * libdnf: Signature verification bypass via signature placed in the main RPM header (CVE-2021-3445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes describedin this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1804234 - yum false positive advisory if module enabled 1818118 - openvswitch: yum update using wrapper file to allow for stream change fails in RHEL-8 1847035 - [modularity] modulefailsafe .yaml file is not removed after module disable/reset 1893176 - dnf aborts when running update 1898293 - repomanage --old does not list the oldest package per module 1904490 - Backtrace when performing "yum module remove --all perl:common" 1906970 - dnf history wrong output if piped through more or redirected to file 1913962 - "dnf needs-restarting -r" work incorrectly inside systemd-nspawn containers1914827 - [RHEL8] dnf reposync implicitly downloads source rpms in spite of no --source option 1918475 - dnf --security pulling in packages without security advisory 1926261 - dnf should not allow an installonly_limit less than 2 1926771 - dnf does not recognize scratch modules NSVC 1929163 - problem with transaction() hook 1929667 - Typos in dnf API documentation 1932079 - CVE-2021-3445 libdnf: Signature verification bypass via signature placed in the main RPM header 1934499 - dnf autoremove wants to remove "kernel-modules-extra" if you have a rawhide kernel installed 1940345 - ip_resolve, timeout, username, password options are ignored for downloading remote "rpm" 1951409 - Rebase libdnf to > = 0.55.2 1951411 - Rebase dnf to > = 4.5.2 1951414 - Rebase dnf-plugins-core to > = 4.0.21 1957280 - DNF with versionlock silences a conflict due to a provide 1961632 - [dnf] RHEL 8.5 Tier 0 Localization 1961633 - [dnf-plugins-core] RHEL 8.5 Tier 0 Localization 1961634 - [libdnf] RHEL 8.5 Tier 0 Localization 1967454 - Backport improvements of dnf signature checking using rpmkeys 6. Package List: Red Hat Enterprise Linux BaseOS (v.8): Source: dnf-4.7.0-4.el8.src.rpm dnf-plugins-core-4.0.21-3.el8.src.rpm libdnf-0.63.0-3.el8.src.rpm aarch64: libdnf-0.63.0-3.el8.aarch64.rpm libdnf-debuginfo-0.63.0-3.el8.aarch64.rpm libdnf-debugsource-0.63.0-3.el8.aarch64.rpm python3-hawkey-0.63.0-3.el8.aarch64.rpm python3-hawkey-debuginfo-0.63.0-3.el8.aarch64.rpm python3-libdnf-0.63.0-3.el8.aarch64.rpm python3-libdnf-debuginfo-0.63.0-3.el8.aarch64.rpm noarch: dnf-4.7.0-4.el8.noarch.rpm dnf-automatic-4.7.0-4.el8.noarch.rpm dnf-data-4.7.0-4.el8.noarch.rpm dnf-plugins-core-4.0.21-3.el8.noarch.rpm python3-dnf-4.7.0-4.el8.noarch.rpm python3-dnf-plugin-post-transaction-actions-4.0.21-3.el8.noarch.rpm python3-dnf-plugin-versionlock-4.0.21-3.el8.noarch.rpm python3-dnf-plugins-core-4.0.21-3.el8.noarch.rpm yum-4.7.0-4.el8.noarch.rpm yum-utils-4.0.21-3.el8.noarch.rpm ppc64le: libdnf-0.63.0-3.el8.ppc64le.rpm libdnf-debuginfo-0.63.0-3.el8.ppc64le.rpm libdnf-debugsource-0.63.0-3.el8.ppc64le.rpm python3-hawkey-0.63.0-3.el8.ppc64le.rpm python3-hawkey-debuginfo-0.63.0-3.el8.ppc64le.rpm python3-libdnf-0.63.0-3.el8.ppc64le.rpm python3-libdnf-debuginfo-0.63.0-3.el8.ppc64le.rpm s390x: libdnf-0.63.0-3.el8.s390x.rpm libdnf-debuginfo-0.63.0-3.el8.s390x.rpm libdnf-debugsource-0.63.0-3.el8.s390x.rpm python3-hawkey-0.63.0-3.el8.s390x.rpm python3-hawkey-debuginfo-0.63.0-3.el8.s390x.rpm python3-libdnf-0.63.0-3.el8.s390x.rpm python3-libdnf-debuginfo-0.63.0-3.el8.s390x.rpm x86_64: libdnf-0.63.0-3.el8.i686.rpm libdnf-0.63.0-3.el8.x86_64.rpm libdnf-debuginfo-0.63.0-3.el8.i686.rpm libdnf-debuginfo-0.63.0-3.el8.x86_64.rpm libdnf-debugsource-0.63.0-3.el8.i686.rpm libdnf-debugsource-0.63.0-3.el8.x86_64.rpm python3-hawkey-0.63.0-3.el8.x86_64.rpm python3-hawkey-debuginfo-0.63.0-3.el8.i686.rpm python3-hawkey-debuginfo-0.63.0-3.el8.x86_64.rpm python3-libdnf-0.63.0-3.el8.x86_64.rpm python3-libdnf-debuginfo-0.63.0-3.el8.i686.rpm python3-libdnf-debuginfo-0.63.0-3.el8.x86_64.rpm Red Hat Enterprise Linux CRB (v.8): aarch64: libdnf-debuginfo-0.63.0-3.el8.aarch64.rpm libdnf-debugsource-0.63.0-3.el8.aarch64.rpm libdnf-devel-0.63.0-3.el8.aarch64.rpm python3-hawkey-debuginfo-0.63.0-3.el8.aarch64.rpm python3-libdnf-debuginfo-0.63.0-3.el8.aarch64.rpm ppc64le: libdnf-debuginfo-0.63.0-3.el8.ppc64le.rpm libdnf-debugsource-0.63.0-3.el8.ppc64le.rpm libdnf-devel-0.63.0-3.el8.ppc64le.rpm python3-hawkey-debuginfo-0.63.0-3.el8.ppc64le.rpm python3-libdnf-debuginfo-0.63.0-3.el8.ppc64le.rpm s390x: libdnf-debuginfo-0.63.0-3.el8.s390x.rpm libdnf-debugsource-0.63.0-3.el8.s390x.rpm libdnf-devel-0.63.0-3.el8.s390x.rpm python3-hawkey-debuginfo-0.63.0-3.el8.s390x.rpm python3-libdnf-debuginfo-0.63.0-3.el8.s390x.rpm x86_64: libdnf-debuginfo-0.63.0-3.el8.i686.rpm libdnf-debuginfo-0.63.0-3.el8.x86_64.rpm libdnf-debugsource-0.63.0-3.el8.i686.rpm libdnf-debugsource-0.63.0-3.el8.x86_64.rpm libdnf-devel-0.63.0-3.el8.i686.rpm libdnf-devel-0.63.0-3.el8.x86_64.rpm python3-hawkey-debuginfo-0.63.0-3.el8.i686.rpm python3-hawkey-debuginfo-0.63.0-3.el8.x86_64.rpm python3-libdnf-debuginfo-0.63.0-3.el8.i686.rpm python3-libdnf-debuginfo-0.63.0-3.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-3445 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/ 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYYrd79zjgjWX9erEAQg+AQ//W0nZXstLWTWmCoVXo6NMtki7ToZB5Jix u7pb2hy+CKDUGqPl/KSPeKg4wvlKIb7SYEEbIKQO5Nv7r2Qnqnd0ebfNeFBT299q yesjEhbUqlOzAIVpg/ryGo4KYvuaseGP0cxuAgZME0TFdvfVGfUf+fTywRi+CP+Q 3r2IcodfFy6su3JEEK1NZXqz1l6kVzrxJrDjGHmqduvSK2tg1eKGKShRDrwQLp9Z dyev6O3rNhDAhZTgUKkVWFqTGpTNrBsf/nEmxlidb/zMDkV9bOr/08vbFUDjtqKh QdBdKfgbbvocbtdkUdrjhXSsG4arN5LwWX+tcz54TCz/sgp9+qvmpaY1d05dqcLt StouGMb33sdR12dGqE3ag9Yo9mYjWOkndfqcldTlVER2obl4JlOdWO44Pw+ELIXa Xsgj809HJe5PdyyiImrxSgaYFjG1FIX1bDzZc3fQuVOGdFAAnTY+mbzIEpSkyCFA jm6XZwYW8nGa/ITX4GV5P5Y5ybx1oB1BLonRSgE8C5C88by6D9fjDvTapgOvaxXr c7VB6s/5YhZNtz8gc0Dr75cZPHtj4sGqlp8I4yzVUL31hNu8bLxjk8KyuAmLAXxd tSu62Q8g93XFa8fumyqgMdCGKexrUFDkJKpSZdEgjRJWyYB9z/TQ5JMdDSMBKJcI h0FA3/A7KL4=IKMX -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Nov 09, 2021
Red Hat
89
security advisoryFedorapackage managerFedora 32: 2020-5d9f0ce2b3 Critical DNF Security Advisory
createrepo_c 0.16.1 - Update to 0.16.1 - Add the section number to the manual pages - Parse xml snippet in smaller parts (RhBug:1859689) - Add module metadata support to createrepo_c (RhBug:1795936) librepo 1.12.1 - Update to 1.12.1 - Validate path read from repomd.xml (RhBug:1868639) libdnf 0.54.2 - Update to 0.54.2 - history: Fix dnf history rollback when a package was removed. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-5d9f0ce2b3 2020-10-18 15:48:50.062311 --------------------------------------------------------------------------------Name : dnf Product : Fedora 32 Version : 4.4.0 Release : 1.fc32 URL : https://github.com/rpm-software-management/dnf Summary : Package manager Description : Utility that allows users to manage packages on their systems. It supports RPMs, modules and comps groups & environments. --------------------------------------------------------------------------------Update Information: createrepo_c 0.16.1 - Update to 0.16.1 - Add the section number to the manual pages - Parse xml snippet in smaller parts (RhBug:1859689) - Add module metadata support to createrepo_c (RhBug:1795936) librepo 1.12.1 - Update to 1.12.1 -Validate path read from repomd.xml (RhBug:1868639) libdnf 0.54.2 - Update to 0.54.2 - history: Fix dnf history rollback when a package was removed (RhBug:1683134) - Add support for HY_GT, HY_LT in query nevra_strict - Fix parsing empty lines in config files - Accept '==' as an operator in reldeps (RhBug:1847946) - Add log file level main config option (RhBug:1802074) - Add protect_running_kernel configuration option (RhBug:1698145) - Context part of libdnf cannot assume zchunk is on (RhBug:1851841,1779104) - Fix memory leak of resultingModuleIndex and handle g_object refs - Redirect librepo logs to libdnf logs with different source - Introduce changelog metadata in commit messages -Add hy_goal_lock - Update Copr targets for packit and usealias - Enum/String conversions for Transaction Store/Replay - utils: Add a method to decode URLs -Unify hawkey.log line format with the rest of the logs dnf 4.4.0 - Update to 4.4.0 - Handle empty comps group name (RhBug:1826198) - Remove dead history info code (RhBug:1845800) - Improve command emmitter in dnf-automatic - Enhance --querytags and --qf help output - [history] add option --reverse to history list (RhBug:1846692) - Add logfilelevel configuration (RhBug:1802074) - Don't turn off stdout/stderr logging longer than necessary (RhBug:1843280) - Mention the date/time that updates were applied - [dnf-automatic] Wait for internet connection (RhBug:1816308) - [doc] Enhance repo variables documentation (RhBug:1848161,1848615) - Add librepo logger for handling messages from librepo (RhBug:1816573) - [doc] Add package-name-spec to the list of possible specs -[doc] Do not use - [doc] Add section to explain -n, -na and -nevra suffixes - Add alias 'ls' for list command - README: Reference Fedora Weblate instead of Zanata - remove log_lock.pid after reboot(Rhbug:1863006) -comps: Raise CompsError when removing a non-existent group - Add methods for working with comps to RPMTransactionItemWrapper - Implement storing and replaying a transaction - Log failure to access last makecache time as warning -[doc] Document Substitutions class - Dont document removed attribute ``reports`` for get_best_selector - Change the debug log timestamps from UTC to local time dnf-plugins-core 4.0.18 - [needs-restarting] Fix plugin fail if needs-restarting.d does not exist - [needs-restarting] add kernel-rt to reboot list -Fix debug-restore command - [config-manager] enable/disable comma separated pkgs (RhBug:1830530) - [debug] Use standard demands.resolving for transaction handling - [debug] Do not remove install-only packages (RhBug:1844533) - return error when dnf download failed - README: Reference Fedora Weblate instead of Zanata - [reposync] Add latest NEVRAs per stream to download (RhBug: 1833074) -copr:don't try to list runtime dependencies dnf-plugins-extras 4.0.12 -Update Cmake to pull translations from weblate - Drop Python 2 support - README: Add Installation, Contribution, etc - Add the DNF_SYSTEM_UPGRADE_NO_REBOOT env variable to control system-upgrade reboot. - [system-upgrade] Upgrade groups and environments (RhBug:1845562,1860408) livecd-tools-27.1-8 - Fix compatibility with dnf 4.4.0 / libdnf 0.54.2 --------------------------------------------------------------------------------ChangeLog: * Wed Oct 7 2020 Nicola Sella - 4.4.0-1 - Update to 4.4.0 - Handle empty comps group name (RhBug:1826198) - Remove dead history info code (RhBug:1845800) - Improve command emmitter in dnf-automatic - Enhance --querytags and --qf help output - [history] add option --reverse to history list (RhBug:1846692) - Add logfilelevel configuration (RhBug:1802074) - Don't turn off stdout/stderr logging longer than necessary (RhBug:1843280) - Mention the date/time that updates were applied - [dnf-automatic] Wait for internet connection (RhBug:1816308) - [doc] Enhance repo variables documentation (RhBug:1848161,1848615) - Add librepo logger for handling messages from librepo (RhBug:1816573) - [doc] Add package-name-spec to the list of possible specs - [doc] Do not use - [doc] Add section to explain -n, -na and -nevra suffixes - Add alias 'ls' for list command - README: Reference Fedora Weblate instead of Zanata - remove log_lock.pid after reboot(Rhbug:1863006) - comps: Raise CompsError when removing a non-existent group - Add methods for working with comps to RPMTransactionItemWrapper - Implement storing and replaying a transaction - Log failure to access last makecache time as warning - [doc] Document Substitutions class - Dont document removed attribute ``reports`` for get_best_selector - Change the debug log timestamps from UTC to local time --------------------------------------------------------------------------------References: [ 1 ] Bug #1683134 - dnf rollback works strangeafter upgrade/downgrade/remove https://bugzilla.redhat.com/show_bug.cgi?id=1683134 [ 2 ] Bug #1698145 - dnf protects certain packages in container, when it should not https://bugzilla.redhat.com/show_bug.cgi?id=1698145 [ 3 ] Bug #1779104 - PackageKit: loading of MD_TYPE_PRIMARY has failed. https://bugzilla.redhat.com/show_bug.cgi?id=1779104 [ 4 ] Bug #1795936 - [RFE] createrepo_c should be able to handle modules information https://bugzilla.redhat.com/show_bug.cgi?id=1795936 [ 5 ] Bug #1802074 - Excessive and non configurable logging in /var/log/dnf.log https://bugzilla.redhat.com/show_bug.cgi?id=1802074 [ 6 ] Bug #1816308 - dnf-automatic.timer runs before the computer can connect to the internet https://bugzilla.redhat.com/show_bug.cgi?id=1816308 [ 7 ] Bug #1816573 - [RHEL8/RFE] dnf logrotation experience differs from RHEL7 (yum) https://bugzilla.redhat.com/show_bug.cgi?id=1816573 [ 8 ] Bug #1830530 - request to re-introduce functionality - dnf [config-manager] --enable/disablerepo a-repo,b-repo,some* https://bugzilla.redhat.com/show_bug.cgi?id=1830530 [ 9 ] Bug #1833074 - reposync --newest-only does not download the latest package https://bugzilla.redhat.com/show_bug.cgi?id=1833074 [ 10 ] Bug #1843280 - Discrepancies in permission related problems not/reporting https://bugzilla.redhat.com/show_bug.cgi?id=1843280 [ 11 ] Bug #1844533 - yum debug-restore removes all but one kernel even though the dump has multiple kernels. https://bugzilla.redhat.com/show_bug.cgi?id=1844533 [ 12 ] Bug #1845562 - system-upgrade plugin should do "dnf group upgrade" as part of transaction solution https://bugzilla.redhat.com/show_bug.cgi?id=1845562 [ 13 ] Bug #1845800 - History info tracebacks when group is upgraded/downgraded https://bugzilla.redhat.com/show_bug.cgi?id=1845800 [ 14 ] Bug #1846692 - dnf should offer a 'history list' in reverse order https://bugzilla.redhat.com/show_bug.cgi?id=1846692 [ 15 ] Bug #1847946 - libdnf behavior has changed unexpectedly in 8.3 https://bugzilla.redhat.com/show_bug.cgi?id=1847946 [ 16 ] Bug #1848161 - Custom DNF variables which worked in CentOS 8.1.1911 are broken in 8.2.2004 https://bugzilla.redhat.com/show_bug.cgi?id=1848161 [ 17 ] Bug #1848615 - dnf numeric variable substitutions are undocumented https://bugzilla.redhat.com/show_bug.cgi?id=1848615 [ 18 ] Bug #1851841 - zchunk issue with packagekit https://bugzilla.redhat.com/show_bug.cgi?id=1851841 [ 19 ] Bug #1859689 - cr_xml_parser_generic_from_string fails on large inputs https://bugzilla.redhat.com/show_bug.cgi?id=1859689 [ 20 ] Bug #1860408 - Perform "dnf mark install fedora-repos-modular"-like action on upgrades to Fedora 33/34 https://bugzilla.redhat.com/show_bug.cgi?id=1860408 [ 21 ] Bug #1863006 - log_lock.pid file remain after system reboot https://bugzilla.redhat.com/show_bug.cgi?id=1863006 [ 22 ] Bug #1868639 - CVE-2020-14352 librepo: missing path validation in repomd.xml may lead to directory traversal [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1868639 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-5d9f0ce2b3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Oct 18, 2020
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!