[Rpm-maint] [rpm-software-management/rpm] Do not allow extra packets to follow a signature (#1704)

[Demi Marie Obenour]

According to RFC 4880 § 11.4, a detached signature is “simply a
Signature packet”.  Therefore, extra packets following a detached
signature are not allowed.  Allowing them substantially increases RPM’s
attack surface, so just reject them.
You can view, comment on, or merge this pull request online at:

  https://github.com/rpm-software-management/rpm/pull/1704

-- Commit Summary --

  * Do not allow extra packets to follow a signature

-- File Changes --

    M rpmio/rpmpgp.c (2)

-- Patch Links --

https://github.com/rpm-software-management/rpm/pull/1704.patch
https://github.com/rpm-software-management/rpm/pull/1704.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1704
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20210616/e48c61ac/attachment.html>