RHBA-2009:1371 - Bug Fix Advisory

Topic

Updated rpm packages that resolve several issues are now available.

Description

The RPM Package Manager (RPM) is a command line driven package management
system capable of installing, uninstalling, verifying, querying, and
updating software packages.

These updated rpm packages provide fixes for the following bugs:

• on 64-bit multilib systems, verifying all packages on the system led to a

large number of files being listed which only differed in timestamp values.
With this update, timestamp differences on multilib systems are now
filtered so that verifying all packages (using the "rpm -Va" command) on
both 32-bit and 64-bit systems results in relevant and useful information
for system administrators. (BZ#426672, BZ#472151)

• verification using the "--root [directory]" option could give false

warnings on file ownership due to using the system's user and group
database instead of the alternate root. RPM now performs verification using
actual chrooted environment to ensure the correct user database is used.
(BZ#434150)

• in some upgrade scenarios YUM would trigger a massive memory

fragmentation in librpm, causing it to use immoderate amounts of memory.
RPM now uses a better allocation algorithm to avoid excessive
fragmentation. In addition, a separate flawed algorithm caused initial
installation to take much longer than it should have. These fixes result in
a better-performing RPM overall. (BZ#435475)

• the "rpmbuild" utility silently applied patches that no longer exactly

match the source code, which could cause packaging of unwanted backup files
or even result in subtle bugs in the software itself. An opt-in mechanism
to enable a stricter mode of patching on a per-spec basis has been
introduced to help packagers notice these cases early in the
package-building process. (BZ#471005)

• on 64-bit multilib systems, RPM permitted installation of packages for

incompatible architectures. RPM now validates package architecture
compatibility on all platforms. (BZ#472065)

• an extra "/" character in source file paths could have caused RPM version

4.4.2.3 to abort builds on packages that were previously able to be built
during the debug-information extraction stage. This update reverts the
error to a warning to let such packages continue to build. (BZ#482903)

• RPM incorrectly calculated the fingerprint of some GPG public keys,

causing false "key not present" errors on package signature-checking. This
update includes a fix to correct the fingerprint calculation in these
cases. (BZ#493777)

• recent RPM versions could fail to verify a valid RSA signature on a

package due to different padding behavior of the low-level cryptography
library now used. RPM now performs the additional zero-padding itself when
necessary, thus allowing RSA signatures to be correctly verified.
(BZ#502791)

• RPM output an invalid Japanese error message when run in a Japanese

locale. The error message translation has been corrected. (BZ#387321)

All users of rpm are advised to upgrade to these updated packages, which
resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 426672 - Make rpm -V be useful again.
• BZ - 435475 - RFE: [Performance] yum update slower as more packages go into each minor release, esp. bad on IA64 hw
• BZ - 471005 - Allow rpmbuild user to prevent application of hunks into wrong contexts
• BZ - 472065 - rpm packages for different architecture can be installed without warnings on x86_64
• BZ - 472151 - rpm verify fails after a fresh install
• BZ - 482903 - debugedit prints: canonicalization unexpectedly shrank by one character
• BZ - 493777 - rpm --import gets the key id wrong
• BZ - 502791 - Signature checking regression caused by beecrypt -> NSS switch
• BZ - 508074 - rpm -Va --root /external_folder fails sometimes

CVEs

(none)

References

(none)