REDHAT-BUG-2440357: Medium severity RPM RPM vulnerability
A crafted RPM file can trigger a Rust panic in the OpenPGP signature parsing code (librpmsequoia) during RPM signature verification. The panic crosses the Rust/C FFI boundary and causes an unconditional abort of the rpm process, resulting in a denial of service. The issue is reachable via standard RPM CLI operations such as rpm -Kv and rpm --checksig without installing the package.
An attacker only needs to supply a specially crafted RPM file to a victim system where the RPM file is processed for signature verification (e.g., rpm -Kv, rpm --checksig, CI pipelines, or automated package validation workflows). No privileges, user interaction, or package installation are required.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2440357?
The severity of REDHAT-BUG-2440357 is classified as a denial of service vulnerability affecting RPM signature verification.
How do I fix REDHAT-BUG-2440357?
To fix REDHAT-BUG-2440357, ensure you update the RPM package to the latest version that addresses this vulnerability.
What software is affected by REDHAT-BUG-2440357?
The affected software includes the RPM and librpm_sequoia packages.
What causes the panic in REDHAT-BUG-2440357?
The panic in REDHAT-BUG-2440357 is triggered by a crafted RPM file during the OpenPGP signature parsing.
Can REDHAT-BUG-2440357 be exploited remotely?
Yes, REDHAT-BUG-2440357 can be exploited remotely through standard RPM signature verification processes.