A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libdnf-devel | May 4, 2022 | May 19, 2021 |
| Centos_linux | — | Upgrade python3-hawkey-debuginfoUpgrade libdnf-debugsourceUpgrade dnf-plugins-coreUpgrade yumUpgrade libdnf-debuginfoUpgrade python3-libdnfUpgrade dnf-automaticUpgrade python3-hawkeyUpgrade dnf-dataUpgrade yum-utilsUpgrade python3-libdnf-debuginfoUpgrade python3-dnfUpgrade libdnfUpgrade python3-dnf-plugin-versionlockUpgrade dnfUpgrade python3-dnf-plugin-post-transaction-actionsUpgrade python3-dnf-plugins-core | Nov 10, 2021 | May 19, 2021 |
| Debian | — | Upgrade libdnf | Jul 30, 2024 | May 19, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-libdnfUpgrade python2-hawkeyUpgrade python3-hawkeyUpgrade libdnfUpgrade python2-libdnf | Sep 24, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-libdnfUpgrade python3-hawkeyUpgrade libdnf | Sep 29, 2021 | May 19, 2021 |
| Oracle_linux | — | Upgrade python3-dnf-plugin-post-transaction-actionsUpgrade python3-dnfUpgrade dnf-dataUpgrade libdnfUpgrade dnfUpgrade python3-libdnfUpgrade yum-utilsUpgrade python3-dnf-plugins-coreUpgrade python3-dnf-plugin-versionlockUpgrade python3-hawkeyUpgrade libdnf-develUpgrade yumUpgrade dnf-automaticUpgrade dnf-plugins-core | Nov 17, 2021 | Mar 16, 2021 |
| Redhat_linux | — | Upgrade dnf-dataUpgrade python3-libdnfUpgrade libdnf-develUpgrade libdnfUpgrade libdnf-debugsourceUpgrade python3-dnfUpgrade dnfUpgrade dnf-automaticUpgrade python3-dnf-plugin-versionlockUpgrade python3-hawkey-debuginfoUpgrade python3-dnf-plugin-post-transaction-actionsUpgrade python3-dnf-plugins-coreUpgrade yumUpgrade dnf-plugins-coreUpgrade python3-hawkeyUpgrade yum-utilsUpgrade python3-libdnf-debuginfoUpgrade libdnf-debuginfo | Nov 10, 2021 | May 19, 2021 |
| Rocky_linux | rocky-upgrade-libdnfrocky-upgrade-libdnf-debuginforocky-upgrade-libdnf-debugsourcerocky-upgrade-libdnf-develrocky-upgrade-python3-hawkeyrocky-upgrade-python3-hawkey-debuginforocky-upgrade-python3-libdnfrocky-upgrade-python3-libdnf-debuginfo | Mar 12, 2024 | May 19, 2021 | |
| Suse | — | suse-upgrade-hawkey-mansuse-upgrade-libdnf-develsuse-upgrade-libdnf-repo-config-zyppsuse-upgrade-libdnf2suse-upgrade-librepo-develsuse-upgrade-librepo0suse-upgrade-python3-hawkeysuse-upgrade-python3-libdnfsuse-upgrade-python3-librepo | Aug 14, 2021 | May 19, 2021 |
| Ubuntu | ubuntu-upgrade-libdnf | Nov 19, 2024 | May 19, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub