CVE-2021-3445

Name of the Vulnerable Software and Affected Versions libdnf versions prior to 0.60.1

Description The issue is related to an error in the signature verification function of the libdnf library, which manages packages. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The flaw enables an attacker to achieve code execution by altering the header information of an RPM package and tricking a user or system into installing it, posing a risk to confidentiality, integrity, and system availability.

Recommendations For versions prior to 0.60.1, update to version 0.60.1 or later to resolve the issue. As a temporary workaround, consider restricting the installation of RPM packages from untrusted sources to minimize the risk of exploitation.