| Summary: | rpm new security issue CVE-2021-3521 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | andrewsfarm, davidwhodgins, mageia, sysadmin-bugs |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | rpm-4.16.1.3-1.1.mga8.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2022-02-02 18:44:11 CET
We need upstream to backport the fixes to the 4.16.x branch: https://github.com/rpm-software-management/rpm/pull/1788#issuecomment-1030591355 RedHat has already done it in CentOS 9 Stream in this commit: https://git.centos.org/rpms/rpm/c/3f3ddd0c8927e60ed546707bac1303a44035f0ec?branch=c9-beta It's rpm-4.16.1.3-validate-and-require-subkey-binding-sigs.patch Status comment:
(none) =>
Patch available from RedHat upstream patch: https://github.com/rpm-software-management/rpm/commit/bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8 CC:
(none) =>
mageia src:
- rpm-4.16.1.3-1.2.mga8Status comment:
Patch available from RedHat =>
(none) rpm-4.16.1.3-1.2.mga8 librpm9-4.16.1.3-1.2.mga8 rpm-build-4.16.1.3-1.2.mga8 python3-rpm-4.16.1.3-1.2.mga8 librpmbuild9-4.16.1.3-1.2.mga8 librpm-devel-4.16.1.3-1.2.mga8 librpmsign9-4.16.1.3-1.2.mga8 rpm-sign-4.16.1.3-1.2.mga8 rpm-plugin-systemd-inhibit-4.16.1.3-1.2.mga8 rpm-plugin-prioreset-4.16.1.3-1.2.mga8 rpm-plugin-audit-4.16.1.3-1.2.mga8 rpm-plugin-selinux-4.16.1.3-1.2.mga8 rpm-plugin-ima-4.16.1.3-1.2.mga8 rpm-plugin-syslog-4.16.1.3-1.2.mga8 rpm-cron-4.16.1.3-1.2.mga8 rpm-apidocs-4.16.1.3-1.2.mga8 from rpm-4.16.1.3-1.2.mga8.src.rpm Tested in VirtualBox. No installation issues using qarepo. Tested by running rpmdrake and installing several games. No installation issues with the games, dependencies were identified and installed without incident. I ran each of the games, and each worked, except one, Bitfighter. That one had a popup that the version is old, and that's about it. (Filing a bug) I then used rpmdrake once more to remove the games, without incident. Giving this an OK, and validating. Whiteboard:
(none) =>
MGA8-64-OK
Dave Hodgins
2022-09-08 18:41:21 CEST
Keywords:
(none) =>
advisory An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0321.html Resolution:
(none) =>
FIXED |