CVE-2012-6088
rpm: Signature checking function returned success on (possibly malicious ) rpm packages
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · February 13, 2023
Updated · April 28, 2026
Description
A flaw was found in rpm. The rpmpkgRead function in lib/package.c in the RPM package does not return an error code in certain situations involving an "unparseable signature." This flaw allows remote attackers to bypass RPM signature checks via a crafted package.
Statement
Not vulnerable. This issue did not affect the versions of rpm as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include the upstream commit e8bc3ff5d780f4ee6656c24464402723e5fb04f4 that introduced this issue.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-347 · Improper Verification of Cryptographic Signature