A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libdnf-devel | May 4, 2022 | May 19, 2021 |
| Centos_linux | — | Upgrade python3-hawkey-debuginfoUpgrade dnf-plugins-coreUpgrade libdnf-debuginfoUpgrade python3-libdnfUpgrade dnf-automaticUpgrade yumUpgrade libdnf-debugsourceUpgrade python3-dnf-plugins-coreUpgrade python3-dnf-plugin-post-transaction-actionsUpgrade python3-libdnf-debuginfoUpgrade dnf-dataUpgrade yum-utilsUpgrade python3-dnfUpgrade python3-dnf-plugin-versionlockUpgrade python3-hawkeyUpgrade libdnfUpgrade dnf | Nov 10, 2021 | May 19, 2021 |
| Debian | — | Upgrade libdnf | Jul 30, 2024 | May 19, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-hawkeyUpgrade python3-hawkeyUpgrade python3-libdnfUpgrade python2-libdnfUpgrade libdnf | Sep 24, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libdnfUpgrade python3-hawkeyUpgrade python3-libdnf | Sep 29, 2021 | May 19, 2021 |
| Oracle_linux | — | Upgrade python3-dnf-plugins-coreUpgrade python3-libdnfUpgrade dnfUpgrade python3-dnf-plugin-post-transaction-actionsUpgrade python3-dnf-plugin-versionlockUpgrade python3-dnfUpgrade dnf-dataUpgrade libdnfUpgrade yum-utilsUpgrade libdnf-develUpgrade python3-hawkeyUpgrade dnf-plugins-coreUpgrade yumUpgrade dnf-automatic | Nov 17, 2021 | Mar 16, 2021 |
| Redhat_linux | — | Upgrade python3-libdnf-debuginfoUpgrade python3-libdnfUpgrade libdnf-develUpgrade libdnfUpgrade dnf-automaticUpgrade dnfUpgrade libdnf-debugsourceUpgrade python3-dnfUpgrade dnf-dataUpgrade python3-dnf-plugin-versionlockUpgrade libdnf-debuginfoUpgrade yum-utilsUpgrade python3-dnf-plugin-post-transaction-actionsUpgrade dnf-plugins-coreUpgrade python3-hawkey-debuginfoUpgrade python3-hawkeyUpgrade yumUpgrade python3-dnf-plugins-core | Nov 10, 2021 | May 19, 2021 |
| Rocky_linux | — | Upgrade libdnf-debuginfoUpgrade libdnf-develUpgrade libdnf-debugsourceUpgrade python3-hawkey-debuginfoUpgrade python3-libdnfUpgrade python3-libdnf-debuginfoUpgrade python3-hawkeyUpgrade libdnf | Mar 12, 2024 | May 19, 2021 |
| Suse | — | Upgrade hawkey-manUpgrade python3-libdnfUpgrade librepo0Upgrade librepo-develUpgrade python3-librepoUpgrade libdnf-develUpgrade libdnf-repo-config-zyppUpgrade python3-hawkeyUpgrade libdnf2 | Aug 14, 2021 | May 19, 2021 |
| Ubuntu | — | Upgrade libdnf | Nov 19, 2024 | May 19, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub