Summary
[4.14.3-28.0.2]
- Import additional patches to fix regressions with CVE-2021-35937,
CVE-2021-35938 and CVE-2021-35939 patchset [Orabug: 36256318]
[4.14.3-28.0.1]
- Fixed infinte loop for db_create with error check [Orabug: 36202920]
[4.14.3-28]
- Backport file handling code from rpm-4.19 to fix CVE-2021-35937,
CVE-2021-35938 and CVE-2021-35939
[4.14.3-27]
- Make brp-python-bytecompile script compatible with Python 3.10+
Resolves: RHEL-6423
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | python3-rpm | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-apidocs | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-build | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-build-libs | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-cron | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-devel | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-libs | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-plugin-fapolicyd | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-plugin-ima | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-plugin-prioreset | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-plugin-selinux | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-plugin-syslog | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-plugin-systemd-inhibit | 0:4.14.3-28.0.2.el8_9 |
| Oracle Linux · 8 | rpm-sign | 0:4.14.3-28.0.2.el8_9 |
Vulnerabilities 3
-
Unscored —
A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks tha…
-
Unscored —
A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installin…
-
Unscored —
It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the pa…