The signature header is not signed, but some data is extracted from it and incorporated into the RPM database. It may be possible to insert an erroneous and/or malicious OpenPGP signature into a signed package this way. It is possible to inject strings into the RPM database that the owner of the database would not wish it to contain.
Acknowledgments: Name: Demi M. Obenour
Created rpm tracking bugs for this issue: Affects: fedora-all [bug 1933867]
Flaw summary: rpmReadPackageFile() is used to read RPM file headers. Internally, it calls headerMergeLegacySigs() which copies signature tags from the signature header to the main RPM metadata header (especially, legacy signatures). The logic in headerMergeLegacySigs() allows for copying of unknown tags from the signature header into the RPM header. Thus, it's possible to supply an RPM file with an unknown tag in the signature header, that gets copied into the RPM metadata header and subsequently placed into the RPM database as a corrupt header tag if the package is installed. This occurs even with the %_pkgverify_level macro set to `all`. Installing such a package causes the header to be inaccessible within the rpm database and could lead to data integrity issues such as corrupt header and bad tag errors when rpm reads the database, installed packages not actually being retrievable (shown as not installed), seemingly missing dependencies that are actually installed, etc... This flaw does not cause data loss or permanent damage to the database, which can be repaired using the `rpmdb --rebuilddb` or `rpm --rebuilddb` commands. Additionally, it requires running rpm against a malicious or malformed package which should never be in the official supported package repositories - so a Man-in-the-middle or attempting to install an unsupported or modified package would be required to trigger this.
Statement: To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM. It is strongly recommended to only use RPMs from trusted repositories.
Created rpm tracking bugs for this issue: Affects: fedora-32 [bug 1938024] Affects: fedora-rawhide [bug 1938025]
Upstream patch: https://github.com/rpm-software-management/rpm/commit/d6a86b5e69e46cc283b1e06c92343319beb42e21
FEDORA-2021-2383d950fd has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2021-662680e477 has been pushed to the Fedora 32 stable repository. If problem still persists, please make note of it in this bug report.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-3421