Bug 830380 – <app-arch/rpm-4.17.1: signature verification vulnerability (CVE-2021-3521)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2022-01-01 04:31:50 UTC]

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature."[1] RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. 1. https://tools.ietf.org/html/rfc4880#section-5.2.1

To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

[Comment 1 Sam James 2022-01-01 04:33:12 UTC]

Patches:
1. https://github.com/rpm-software-management/rpm/commit/7b399fcb8f52566e6f3b4327197a85facd08db91
2. https://github.com/rpm-software-management/rpm/commit/236b802a4aa48711823a191d1b7f753c82a89ec5
3. https://github.com/rpm-software-management/rpm/commit/bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8

Tangentially: https://github.com/rpm-software-management/rpm/pull/1844#issuecomment-992541341 (there's some other useful, not necessarily strictly related security fixes going on).

[Comment 2 Larry the Git Cow 2022-07-05 01:13:30 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=188ca6ba0a28ffdcbb063d0bf126a2ed8769448b

commit 188ca6ba0a28ffdcbb063d0bf126a2ed8769448b
Author:     Sam James <[e-mail]>
AuthorDate: 2022-07-05 01:13:04 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-07-05 01:13:25 +0000

    app-arch/rpm: add 4.17.1
    
    Bug: https://bugs.gentoo.org/830380
    Signed-off-by: Sam James <[e-mail]>

 app-arch/rpm/Manifest          |   1 +
 app-arch/rpm/rpm-4.17.1.ebuild | 161 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 162 insertions(+)

[Comment 3 Larry the Git Cow 2022-10-21 17:55:21 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5078a9788b7ff36a1af60ad7a701d958e37206e1

commit 5078a9788b7ff36a1af60ad7a701d958e37206e1
Author:     John Helmert III <[e-mail]>
AuthorDate: 2022-10-21 17:53:55 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-10-21 17:55:15 +0000

    app-arch/rpm: drop 4.17.0-r2
    
    Bug: https://bugs.gentoo.org/830380
    Signed-off-by: John Helmert III <[e-mail]>

 app-arch/rpm/Manifest             |   1 -
 app-arch/rpm/rpm-4.17.0-r2.ebuild | 158 --------------------------------------
 2 files changed, 159 deletions(-)

[Comment 4 John Helmert III 2022-10-21 17:56:35 UTC]

GLSA request filed.

[Comment 5 Larry the Git Cow 2022-10-31 01:42:24 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=d1fba8b4347d1cc39def2710ba7880b64f060ea2

commit d1fba8b4347d1cc39def2710ba7880b64f060ea2
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-10-31 01:15:56 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-10-31 01:40:15 +0000

    [ GLSA 202210-22 ] RPM: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/830380
    Bug: https://bugs.gentoo.org/866716
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202210-22.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

[Comment 6 John Helmert III 2022-10-31 02:18:46 UTC]

GLSA released, all done!