A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libdnf-devel | May 4, 2022 | May 19, 2021 |
| Centos_linux | — | Upgrade python3-hawkey-debuginfoUpgrade python3-libdnfUpgrade yumUpgrade dnf-automaticUpgrade libdnf-debuginfoUpgrade libdnf-debugsourceUpgrade dnf-plugins-coreUpgrade dnf-dataUpgrade yum-utilsUpgrade dnfUpgrade python3-dnfUpgrade python3-libdnf-debuginfoUpgrade python3-dnf-plugin-versionlockUpgrade python3-hawkeyUpgrade python3-dnf-plugin-post-transaction-actionsUpgrade libdnfUpgrade python3-dnf-plugins-core | Nov 10, 2021 | May 19, 2021 |
| Debian | — | Upgrade libdnf | Jul 30, 2024 | May 19, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-libdnfUpgrade libdnfUpgrade python2-libdnfUpgrade python3-hawkeyUpgrade python2-hawkey | Sep 24, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-libdnfUpgrade libdnfUpgrade python3-hawkey | Sep 29, 2021 | May 19, 2021 |
| Oracle_linux | — | Upgrade python3-dnf-plugin-versionlockUpgrade libdnfUpgrade python3-dnfUpgrade python3-dnf-plugins-coreUpgrade dnfUpgrade python3-dnf-plugin-post-transaction-actionsUpgrade dnf-dataUpgrade yum-utilsUpgrade python3-libdnfUpgrade dnf-plugins-coreUpgrade dnf-automaticUpgrade yumUpgrade python3-hawkeyUpgrade libdnf-devel | Nov 17, 2021 | Mar 16, 2021 |
| Redhat_linux | — | Upgrade python3-libdnf-debuginfoUpgrade dnf-plugins-coreUpgrade python3-hawkeyUpgrade python3-dnf-plugins-coreUpgrade yumUpgrade python3-hawkey-debuginfoUpgrade libdnf-debuginfoUpgrade yum-utilsUpgrade python3-dnf-plugin-post-transaction-actionsUpgrade python3-libdnfUpgrade libdnf-debugsourceUpgrade dnf-dataUpgrade dnf-automaticUpgrade python3-dnf-plugin-versionlockUpgrade libdnf-develUpgrade dnfUpgrade libdnfUpgrade python3-dnf | Nov 10, 2021 | May 19, 2021 |
| Rocky_linux | — | Upgrade libdnfUpgrade python3-libdnf-debuginfoUpgrade python3-hawkeyUpgrade python3-libdnfUpgrade libdnf-debuginfoUpgrade libdnf-develUpgrade libdnf-debugsourceUpgrade python3-hawkey-debuginfo | Mar 12, 2024 | May 19, 2021 |
| Suse | — | Upgrade python3-hawkeyUpgrade libdnf-repo-config-zyppUpgrade libdnf-develUpgrade libdnf2Upgrade python3-libdnfUpgrade librepo0Upgrade hawkey-manUpgrade python3-librepoUpgrade librepo-devel | Aug 14, 2021 | May 19, 2021 |
| Ubuntu | — | Upgrade libdnf | Nov 19, 2024 | May 19, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub