Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 830380 (CVE-2021-3521) - <app-arch/rpm-4.17.1: signature verification vulnerability (CVE-2021-3521)
Summary: <app-arch/rpm-4.17.1: signature verification vulnerability (CVE-2021-3521)
Status: IN_PROGRESS
Alias: CVE-2021-3521
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [stable?]
Keywords:
Depends on:
Blocks:
 
Reported: 2022-01-01 04:31 UTC by Sam James
Modified: 2022-07-05 01:14 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-01-01 04:31:50 UTC
There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a &quot;binding signature.&quot;[1] RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. 1. https://tools.ietf.org/html/rfc4880#section-5.2.1

To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.
Comment 2 Larry the Git Cow gentoo-dev 2022-07-05 01:13:30 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=188ca6ba0a28ffdcbb063d0bf126a2ed8769448b

commit 188ca6ba0a28ffdcbb063d0bf126a2ed8769448b
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-07-05 01:13:04 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-07-05 01:13:25 +0000

    app-arch/rpm: add 4.17.1
    
    Bug: https://bugs.gentoo.org/830380
    Signed-off-by: Sam James <sam@gentoo.org>

 app-arch/rpm/Manifest          |   1 +
 app-arch/rpm/rpm-4.17.1.ebuild | 161 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 162 insertions(+)