A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libdnf-devel | May 4, 2022 | May 19, 2021 |
| Centos_linux | — | Upgrade dnf-dataUpgrade yum-utilsUpgrade dnfUpgrade python3-dnf-plugin-versionlockUpgrade python3-hawkeyUpgrade python3-dnf-plugins-coreUpgrade libdnfUpgrade python3-dnf-plugin-post-transaction-actionsUpgrade python3-dnfUpgrade python3-libdnf-debuginfoUpgrade yumUpgrade libdnf-debuginfoUpgrade python3-libdnfUpgrade dnf-automaticUpgrade python3-hawkey-debuginfoUpgrade libdnf-debugsourceUpgrade dnf-plugins-core | Nov 10, 2021 | May 19, 2021 |
| Debian | — | Upgrade libdnf | Jul 30, 2024 | May 19, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-libdnfUpgrade libdnfUpgrade python3-libdnfUpgrade python3-hawkeyUpgrade python2-hawkey | Sep 24, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-hawkeyUpgrade libdnfUpgrade python3-libdnf | Sep 29, 2021 | May 19, 2021 |
| Oracle_linux | — | Upgrade dnf-automaticUpgrade dnf-plugins-coreUpgrade yumUpgrade python3-hawkeyUpgrade libdnf-develUpgrade libdnfUpgrade dnf-dataUpgrade python3-dnf-plugin-versionlockUpgrade dnfUpgrade yum-utilsUpgrade python3-dnfUpgrade python3-dnf-plugin-post-transaction-actionsUpgrade python3-libdnfUpgrade python3-dnf-plugins-core | Nov 17, 2021 | Mar 16, 2021 |
| Redhat_linux | — | Upgrade python3-dnf-plugins-coreUpgrade yum-utilsUpgrade yumUpgrade python3-libdnf-debuginfoUpgrade python3-hawkeyUpgrade libdnf-debuginfoUpgrade python3-hawkey-debuginfoUpgrade dnf-plugins-coreUpgrade python3-dnf-plugin-post-transaction-actionsUpgrade dnfUpgrade python3-dnfUpgrade libdnf-debugsourceUpgrade libdnf-develUpgrade libdnfUpgrade python3-libdnfUpgrade dnf-automaticUpgrade python3-dnf-plugin-versionlockUpgrade dnf-data | Nov 10, 2021 | May 19, 2021 |
| Rocky_linux | — | Upgrade python3-libdnf-debuginfoUpgrade libdnfUpgrade python3-hawkeyUpgrade python3-libdnfUpgrade libdnf-develUpgrade libdnf-debugsourceUpgrade libdnf-debuginfoUpgrade python3-hawkey-debuginfo | Mar 12, 2024 | May 19, 2021 |
| Suse | — | Upgrade libdnf-repo-config-zyppUpgrade libdnf-develUpgrade libdnf2Upgrade python3-hawkeyUpgrade librepo0Upgrade hawkey-manUpgrade python3-librepoUpgrade librepo-develUpgrade python3-libdnf | Aug 14, 2021 | May 19, 2021 |
| Ubuntu | — | Upgrade libdnf | Nov 19, 2024 | May 19, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub