Bug 1941098 (CVE-2021-3521) - CVE-2021-3521 rpm: RPM does not require subkeys to have a valid binding signature
Summary: CVE-2021-3521 rpm: RPM does not require subkeys to have a valid binding signa...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-3521
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1944184 1944185 1944186 1944193 1943723 1943724 1944187 1944188 1944189 1944190 1944191 1944192 1944194 1958478 1958479 1958480 2022537
Blocks: 1937505
TreeView+ depends on / blocked
 
Reported: 2021-03-19 23:22 UTC by Todd Cullum
Modified: 2022-05-17 10:00 UTC (History)
18 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature."[1] RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. 1. https://tools.ietf.org/html/rfc4880#section-5.2.1
Clone Of:
Environment:
Last Closed: 2022-03-02 22:19:35 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github rpm-software-management rpm pull 1795 0 None Merged Validate and require subkey binding signatures on PGP public keys 2021-12-09 15:00:39 UTC
Red Hat Product Errata RHSA-2022:0254 0 None None None 2022-01-25 09:27:36 UTC
Red Hat Product Errata RHSA-2022:0368 0 None None None 2022-02-01 21:01:56 UTC
Red Hat Product Errata RHSA-2022:0634 0 None None None 2022-02-22 15:54:24 UTC

Description Todd Cullum 2021-03-19 23:22:25 UTC 
RPM does not require subkeys to have a valid binding signature. This could potentially result in a signature being wrongly trusted in the following (rather contrived) scenario: A malicious subkey (to which an attacker has the secret key) is added to a legitimate public key, via a process that rejects main keys but not subkeys and does not itself check binding signatures. The main key is exported and then imported into RPM.
Comment 1 Todd Cullum 2021-03-19 23:22:28 UTC 
Acknowledgments:

Name: Demi M. Obenour
Comment 6 Todd Cullum 2021-04-05 22:10:02 UTC 
Statement:

To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key.  It is strongly recommended to only use RPMs and public keys from trusted sources.
Comment 27 Todd Cullum 2021-10-04 18:28:33 UTC 
Upstream fix commit: https://github.com/rpm-software-management/rpm/pull/1788
Comment 32 errata-xmlrpc 2022-01-25 09:27:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:0254 https://access.redhat.com/errata/RHSA-2022:0254
Comment 33 errata-xmlrpc 2022-02-01 21:01:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:0368 https://access.redhat.com/errata/RHSA-2022:0368
Comment 34 errata-xmlrpc 2022-02-22 15:54:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:0634 https://access.redhat.com/errata/RHSA-2022:0634
Comment 35 Product Security DevOps Team 2022-03-02 22:19:31 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3521
Note You need to log in before you can comment on or make changes to this bug.