Date: Wed, 27 Mar 2013 12:25:13 -0400 (EDT) From: Jan Lieskovsky <jlieskov@...hat.com> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...us.mitre.org>, James Antill <james.antill@...hat.com>, Zdenek Pavlas <zpavlas@...hat.com> Subject: CVE Request -- yum: Not removing bad metadata and using it in next run Hello Kurt, Steve, vendors, A security flaw was found in the way Yum package manager performed management of repository metadata in certain circumstances (bad metadata were not removed properly and re-used in subsequent run). An attacker could inject a specially-crafted Trojan horse file in the metadata of a remote repository, possibly leading to their ability to confuse Yum package manager to accept invalid untrusted metadata as valid by mistake. References:  https://bugzilla.redhat.com/show_bug.cgi?id=910446  http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099496.html  http://lists.fedoraproject.org/pipermail/package-announce/2013-March/100299.html  https://lwn.net/Articles/540426/ (and search for 'yum: denial of service' here) Relevant upstream patch:  http://yum.baseurl.org/gitweb?p=yum.git;a=commitdiff;h=c148eb10b798270b3d15087433c8efb2a79a69d0 This issue was found by James Antill of Red Hat. Could you allocate a CVE id for this? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team P.S.: For those possibly wondering why  and  are public already - it's true this has been fixed some time ago already (but I wasn't around at that time) and better to request later, than never. Thank you for your understanding, Jan.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.