RHSA-2021:4464 - Security Advisory

Topic

An update for dnf, dnf-plugins-core, and libdnf is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

dnf is a package manager that allows users to manage packages on their systems. It supports RPMs, modules and comps groups & environments.

Security Fix(es):

• libdnf: Signature verification bypass via signature placed in the main RPM header (CVE-2021-3445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

• BZ - 1804234 - yum false positive advisory if module enabled
• BZ - 1818118 - openvswitch: yum update using wrapper file to allow for stream change fails in RHEL-8
• BZ - 1847035 - [modularity] modulefailsafe .yaml file is not removed after module disable/reset
• BZ - 1893176 - dnf aborts when running update
• BZ - 1898293 - repomanage --old does not list the oldest package per module
• BZ - 1904490 - Backtrace when performing "yum module remove --all perl:common"
• BZ - 1906970 - dnf history wrong output if piped through more or redirected to file
• BZ - 1913962 - "dnf needs-restarting -r" work incorrectly inside systemd-nspawn containers
• BZ - 1914827 - [RHEL8] dnf reposync implicitly downloads source rpms in spite of no --source option
• BZ - 1918475 - dnf --security pulling in packages without security advisory
• BZ - 1926261 - dnf should not allow an installonly_limit less than 2
• BZ - 1926771 - dnf does not recognize scratch modules NSVC
• BZ - 1929163 - problem with transaction() hook
• BZ - 1929667 - Typos in dnf API documentation
• BZ - 1932079 - CVE-2021-3445 libdnf: Signature verification bypass via signature placed in the main RPM header
• BZ - 1934499 - dnf autoremove wants to remove "kernel-modules-extra" if you have a rawhide kernel installed
• BZ - 1940345 - ip_resolve, timeout, username, password options are ignored for downloading remote "rpm"
• BZ - 1951409 - Rebase libdnf to >= 0.55.2
• BZ - 1951411 - Rebase dnf to >= 4.5.2
• BZ - 1951414 - Rebase dnf-plugins-core to >= 4.0.21
• BZ - 1957280 - DNF with versionlock silences a conflict due to a provide
• BZ - 1961632 - [dnf] RHEL 8.5 Tier 0 Localization
• BZ - 1961633 - [dnf-plugins-core] RHEL 8.5 Tier 0 Localization
• BZ - 1961634 - [libdnf] RHEL 8.5 Tier 0 Localization
• BZ - 1967454 - Backport improvements of dnf signature checking using rpmkeys

CVEs

• CVE-2021-3445

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/