Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

dnf Package Manager: Signature Verification Bypass

published 4 years ago
Summary

The dnf package manager, which helps manage software on your system, has a security flaw that could allow attackers to trick the system into installing malicious software. This update fixes the issue and we recommend installing it to keep your system secure. To stay up-to-date, check for updates and install the latest version of dnf.

What to do
  • Update almalinux libdnf-devel to version 0.63.0-3.el8.
Affected software
Ecosystem VendorProductAffected versions
AlmaLinux:8 almalinux libdnf-devel < 0.63.0-3.el8
Fix: upgrade to 0.63.0-3.el8
Original advisory text
Moderate: dnf security and bug fix update
dnf is a package manager that allows users to manage packages on their systems. It supports RPMs, modules and comps groups & environments.

Security Fix(es):

* libdnf: Signature verification bypass via signature placed in the main RPM header (CVE-2021-3445)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
References
Timeline
Published9 Nov 2021
Updated29 Mar 2026
First seen29 Mar 2026
Sources
ALSA-2021:4464 · OSV
Track software like this
Free during beta