CVE-2021-3445
Description
A flaw was found in libdnfs signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.
Risk Information
Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.038
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| (RHSA-2021:4464)Moderate: security and bug fix update dnf-4.7.0-4.el8.noarch.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update dnf-automatic-4.7.0-4.el8.noarch.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update dnf-data-4.7.0-4.el8.noarch.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update dnf-plugins-core-4.0.21-3.el8.noarch.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update libdnf-0.63.0-3.el8.i686.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update libdnf-0.63.0-3.el8.x86_64.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update libdnf-debuginfo-0.63.0-3.el8.i686.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update libdnf-debuginfo-0.63.0-3.el8.x86_64.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update libdnf-debugsource-0.63.0-3.el8.i686.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update libdnf-debugsource-0.63.0-3.el8.x86_64.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update python3-dnf-4.7.0-4.el8.noarch.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update python3-dnf-plugin-post-transaction-actions-4.0.21-3.el8.noarch.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update python3-dnf-plugin-versionlock-4.0.21-3.el8.noarch.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update python3-dnf-plugins-core-4.0.21-3.el8.noarch.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update python3-hawkey-0.63.0-3.el8.x86_64.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update python3-hawkey-debuginfo-0.63.0-3.el8.i686.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update python3-hawkey-debuginfo-0.63.0-3.el8.x86_64.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update python3-libdnf-0.63.0-3.el8.x86_64.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update python3-libdnf-debuginfo-0.63.0-3.el8.i686.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update python3-libdnf-debuginfo-0.63.0-3.el8.x86_64.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update yum-4.7.0-4.el8.noarch.rpm | Linux |
| (RHSA-2021:4464)Moderate: security and bug fix update yum-utils-4.0.21-3.el8.noarch.rpm | Linux |
| Dnf update (ELSA-2021-4464) dnf-4.7.0-4.0.1.el8.noarch.rpm | Linux |
| Dnf-automatic update (ELSA-2021-4464) dnf-automatic-4.7.0-4.0.1.el8.noarch.rpm | Linux |
| Dnf-data update (ELSA-2021-4464) dnf-data-4.7.0-4.0.1.el8.noarch.rpm | Linux |
| Dnf-plugins-core update (ELSA-2021-4464) dnf-plugins-core-4.0.21-3.0.1.el8.noarch.rpm | Linux |
| Libdnf update (ELSA-2021-4464) libdnf-0.63.0-3.0.1.el8.i686.rpm | Linux |
| Libdnf update (ELSA-2021-4464) libdnf-0.63.0-3.0.1.el8.x86_64.rpm | Linux |
| Python3-dnf update (ELSA-2021-4464) python3-dnf-4.7.0-4.0.1.el8.noarch.rpm | Linux |
| Python3-dnf-plugin-post-transaction-actions update (ELSA-2021-4464) python3-dnf-plugin-post-transaction-actions-4.0.21-3.0.1.el8.noarch.rpm | Linux |
| Python3-dnf-plugin-versionlock update (ELSA-2021-4464) python3-dnf-plugin-versionlock-4.0.21-3.0.1.el8.noarch.rpm | Linux |
| Python3-dnf-plugins-core update (ELSA-2021-4464) python3-dnf-plugins-core-4.0.21-3.0.1.el8.noarch.rpm | Linux |
| Python3-hawkey update (ELSA-2021-4464) python3-hawkey-0.63.0-3.0.1.el8.x86_64.rpm | Linux |
| Python3-libdnf update (ELSA-2021-4464) python3-libdnf-0.63.0-3.0.1.el8.x86_64.rpm | Linux |
| Yum update (ELSA-2021-4464) yum-4.7.0-4.0.1.el8.noarch.rpm | Linux |
| Yum-utils update (ELSA-2021-4464) yum-utils-4.0.21-3.0.1.el8.noarch.rpm | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234