Summary
[4.14.3-19.2]
- Address covscan issues in binding sigs validation patch (#2022537)
[4.14.3-19.1]
- Validate and require subkey binding sigs on PGP pubkeys (#2022537)
- Fixes CVE-2021-3521
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | python3-rpm | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-apidocs | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-build | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-build-libs | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-cron | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-devel | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-libs | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-plugin-fapolicyd | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-plugin-ima | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-plugin-prioreset | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-plugin-selinux | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-plugin-syslog | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-plugin-systemd-inhibit | 0:4.14.3-19.el8_5.2 |
| Oracle Linux · 8 | rpm-sign | 0:4.14.3-19.el8_5.2 |
Vulnerabilities 1
-
Unscored —
There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding sign…