File _patchinfo of Package patchinfo.21495

<patchinfo incident="21495">
  <issue tracker="bnc" id="1188548"></issue>
  <issue tracker="bnc" id="1179416">[Build 20201129] openQA test fails in await_install: rpm segfault</issue>
  <issue tracker="bnc" id="1183659">L3: rpmdb corruption on rpm --import</issue>
  <issue tracker="bnc" id="1183543">VUL-0: CVE-2021-3421: rpm: unsigned signature header leads to string injection into an rpm database</issue>
  <issue tracker="bnc" id="1187670">RPM on Leap 15.2 and 15.3 fail to detect zstd compressed archives</issue>
  <issue tracker="bnc" id="1185299">VUL-0: rpm: There are several issues in RPM</issue>
  <issue tracker="bnc" id="1183545">VUL-0: CVE-2021-20271: rpm: Signature checks bypass via corrupted rpm package</issue>
  <issue tracker="bnc" id="1183632">VUL-1: CVE-2021-20266: rpm: missing length checks in hdrblobInit()</issue>
  <issue tracker="cve" id="2021-3421"/>
  <issue tracker="cve" id="2021-20271"/>
  <issue tracker="cve" id="2021-20266"/>
  <packager>mlschroe</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for rpm</summary>
  <description>This update for rpm fixes the following issues:

Security issues fixed:

- CVE-2021-3421, CVE-2021-20271, CVE-2021-20266: Multiple header check improvements (bsc#1183543, bsc#1183545, bsc#1183632)
- PGP hardening changes (bsc#1185299)
- Fixed potential access of freed mem in ndb's glue code (bsc#1179416)

Maintaince issues fixed:

- Fixed zstd detection (bsc#1187670)
- Added ndb rofs support (bsc#1188548)
- Fixed deadlock when multiple rpm processes try tp acquire the database lock (bsc#1183659)
</description>
</patchinfo>