diff options
| author | Levente Polyak <anthraxx@archlinux.org> | 2015-07-18 17:58:23 +0200 |
|---|---|---|
| committer | Allan McRae <allan@archlinux.org> | 2015-07-20 04:50:39 +0200 |
| commit | deac9731884a83ad91eab9f27b288f406f56c87b (patch) | |
| tree | 7c87d265e54cf3c64d5cd2a19aee3821e82f3389 /lib/libalpm/db.c | |
| parent | 445aa3b52cfcd5630ec10d2ae2c8eeffa2b5c5de (diff) | |
| download | pacman-deac9731884a83ad91eab9f27b288f406f56c87b.tar.gz pacman-deac9731884a83ad91eab9f27b288f406f56c87b.tar.xz | |
ensure matching database and package version
While loading each package ensure that the internal version matches the
expected database version to avoid the possibility to circumvent the
version check.
This issue can be used by an attacker to trick the software into
installing an older version. The behavior can be exploited by a
man-in-the-middle attack through specially crafted database tarball
containing a higher version, yet actually delivering an older and
vulnerable version, which was previously shipped.
Signed-off-by: Levente Polyak <anthraxx@archlinux.org>
Signed-off-by: Remi Gacogne <rgacogne@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
Diffstat (limited to 'lib/libalpm/db.c')
0 files changed, 0 insertions, 0 deletions