Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 830380 (CVE-2021-3521) - <app-arch/rpm-4.17.1: signature verification vulnerability (CVE-2021-3521)
Summary: <app-arch/rpm-4.17.1: signature verification vulnerability (CVE-2021-3521)
Status: RESOLVED FIXED
Alias: CVE-2021-3521
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [glsa+]
Keywords:
Depends on: 877041
Blocks:
  Show dependency tree
 
Reported: 2022-01-01 04:31 UTC by Sam James
Modified: 2022-10-31 02:18 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-01-01 04:31:50 UTC
There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a &quot;binding signature.&quot;[1] RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. 1. https://tools.ietf.org/html/rfc4880#section-5.2.1

To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.
Comment 2 Larry the Git Cow gentoo-dev 2022-07-05 01:13:30 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=188ca6ba0a28ffdcbb063d0bf126a2ed8769448b

commit 188ca6ba0a28ffdcbb063d0bf126a2ed8769448b
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-07-05 01:13:04 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-07-05 01:13:25 +0000

    app-arch/rpm: add 4.17.1
    
    Bug: https://bugs.gentoo.org/830380
    Signed-off-by: Sam James <sam@gentoo.org>

 app-arch/rpm/Manifest          |   1 +
 app-arch/rpm/rpm-4.17.1.ebuild | 161 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 162 insertions(+)
Comment 3 Larry the Git Cow gentoo-dev 2022-10-21 17:55:21 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5078a9788b7ff36a1af60ad7a701d958e37206e1

commit 5078a9788b7ff36a1af60ad7a701d958e37206e1
Author:     John Helmert III <ajak@gentoo.org>
AuthorDate: 2022-10-21 17:53:55 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-10-21 17:55:15 +0000

    app-arch/rpm: drop 4.17.0-r2
    
    Bug: https://bugs.gentoo.org/830380
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 app-arch/rpm/Manifest             |   1 -
 app-arch/rpm/rpm-4.17.0-r2.ebuild | 158 --------------------------------------
 2 files changed, 159 deletions(-)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-10-21 17:56:35 UTC
GLSA request filed.
Comment 5 Larry the Git Cow gentoo-dev 2022-10-31 01:42:24 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=d1fba8b4347d1cc39def2710ba7880b64f060ea2

commit d1fba8b4347d1cc39def2710ba7880b64f060ea2
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-10-31 01:15:56 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-10-31 01:40:15 +0000

    [ GLSA 202210-22 ] RPM: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/830380
    Bug: https://bugs.gentoo.org/866716
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202210-22.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
Comment 6 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-10-31 02:18:46 UTC
GLSA released, all done!