SB2021081846 - Anolis OS update for rpm (Anolis OS 8.2)

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Insufficient verification of data authenticity (CVE-ID: CVE-2021-20271)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an error in RPM's signature check functionality when reading package files. A remote attacker can create a specially crafted package with a modified signature header, trick the victim into installing and compromise the affected system.

2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2021-3421)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to insufficient signature validation in the read functionality n the RPM package. A remote attacker can trick the victim into installing a seemingly verifiable package and cause RPM database corruption.

Remediation

Install update from vendor's website.

References

• https://anas.openanolis.cn/errata/detail/ANSA-2021:0140