Bug 744858 (CVE-2012-0060)
| Summary: | CVE-2012-0060 rpm: insufficient validation of region tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Ramon de C Valle <rcvalle> | ||||||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||||||
| Severity: | high | Docs Contact: | |||||||||||
| Priority: | high | ||||||||||||
| Version: | unspecified | CC: | bressers, jnovy, pinto.elia, pkis, pmatilai, security-response-team | ||||||||||
| Target Milestone: | --- | Keywords: | Security | ||||||||||
| Target Release: | --- | ||||||||||||
| Hardware: | Unspecified | ||||||||||||
| OS: | Linux | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | rpm 4.9.1.3 | Doc Type: | Bug Fix | ||||||||||
| Doc Text: | Story Points: | --- | |||||||||||
| Clone Of: | Environment: | ||||||||||||
| Last Closed: | 2012-05-07 09:56:09 UTC | Type: | --- | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Embargoed: | |||||||||||||
| Bug Depends On: | 785109, 785110, 785111, 785112, 785113, 785769, 785803, 785805, 785807, 785862, 809487, 830759 | ||||||||||||
| Bug Blocks: | 744203 | ||||||||||||
| Attachments: |
|
||||||||||||
|
Comment 63
Ramon de C Valle
2012-01-26 17:03:10 UTC
Created attachment 566531 [details]
RPM 4.8.x patch - headerLoad
Created attachment 566532 [details]
RPM 4.8.x patch - headerVerify and rpmReadSignature
Created attachment 566535 [details]
RPM 4.4.x patch - headerLoad
Created attachment 566536 [details]
RPM 4.4.x patch - headerVerify and rpmReadSignature
Lifting embargo. Fixes committed upstream in: http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=e4eab2bc6d07cfd33f740071de7ddbb2fe2f4190 http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=f23998251992b8ae25faf5113c42fee2c49c7f29 Created rpm tracking bugs for this issue Affects: fedora-all [bug 809487] Fixes included in upstream version 4.9.1.3: http://rpm.org/wiki/Releases/4.9.1.3 This issue has been addressed in following products: Red Hat Enterprise Linux 3 Extended Lifecycle Support Red Hat Enterprise Linux 5.3 Long Life Red Hat Enterprise Linux 5.6 EUS - Server Only Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6.0 EUS - Server Only Red Hat Enterprise Linux 6.1 EUS - Server Only Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 4 Extended Lifecycle Support Via RHSA-2012:0451 https://rhn.redhat.com/errata/RHSA-2012-0451.html rpm-4.9.1.3-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. rpm-4.9.1.3-1.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report. rpm-4.9.1.3-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report. Acknowledgements: This issue was discovered by Ramon de C Valle of the Red Hat Product Security Team. |