huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2021-33516: gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services
Component: gupnp
Severity: Important
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 8.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L)
Public date: 2021-05-24T00:00:00+00:00

A flaw was found in gupnp. DNS rebinding can occur when a victim's browser is used by a remote web server to trigger actions against local UPnP services including data exfiltration, data tempering, and other exploits. The highest threat from this vulnerability is to data confidentiality and integrity.


Affected upstream versions: n/a
Fixed upstream versions: gupnp-1.2.5
Upstream repository: https://gitlab.gnome.org/GNOME/gupnp
Upstream fix commit: ca6ec9dcb26fd7a2a630eb6a68118659b589afac
CVE-2021-33571: django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
Component: django
Severity: Moderate
CWE: CWE-918 (Server-Side Request Forgery (SSRF))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2021-06-02T00:00:00+00:00

A flaw was found in django. Leading zeros in octal literals aren't prohibited in IP addresses. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. The highest threat from this vulnerability is to data integrity.

Statement: Red Hat Update Infrastructure is in maintenance phase and we will not be fixing Medium/Low impact security bugs. Reference: https://access.redhat.com/support/policy/updates/rhui

In Red Hat OpenStack Platform 13, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-django package.

Affected upstream versions: n/a
Fixed upstream versions: stable/2.2.x
Upstream repository: https://github.com/django/django
Upstream fix commit: f27c38ab5d90f68c9dd60cabef248a570c0be8fc
CVE-2021-33630: kernel: net/sched: cbs NULL pointer dereference when offloading is enabled
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-01-18T00:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel's network scheduler. This issue occurs when offloading is enabled, the cbs instance is not added to the list. The code also incorrectly handles the case when offload is disabled without removing the qdisc. This could allow a local user to cause a denial of service condition.


Affected upstream versions: <= v5.3
Fixed upstream versions: v5.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3e8b9bfa110896f95d602d8c98d5f9d67e41d78c
CVE-2021-33631: kernel: ext4: kernel bug in ext4_write_inline_data_end()
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-01-18T00:00:00+00:00

A flaw was found in the openEuler kernel in Linux filesystem modules that allows an integer overflow via mounting a corrupted filesystem. This issue affects the openEuler kernel in versions from 4.19.90 through 4.19.90-2401.3 and 5.10.0-60.18.0 through 5.10.0-183.0.0.

Statement: Red Hat has protection mechanisms in place against buffer overflows, such as FORTIFY_SOURCE, Position Independent Executables or Stack Smashing Protection.

Affected upstream versions: <= v6.0
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 5c099c4fdc438014d5893629e70a8ba934433ee8
CVE-2021-33655: kernel: malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-07-08T09:00:00+00:00

An out-of-bounds write flaw was found in the Linux kernel’s framebuffer-based console driver functionality in the way a user triggers ioctl FBIOPUT_VSCREENINFO with malicious data. This flaw allows a local user to crash or potentially escalate their privileges on the system.


Affected upstream versions: 5.18 5.19.0-rc1
Fixed upstream versions: v5.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 086ff84617185393a0bbf25830c4f36412a7d3f4
CVE-2021-33909: kernel: size_t-to-int conversion vulnerability in the filesystem layer
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-07-20T12:00:00+00:00

An out-of-bounds write flaw was found in the Linux kernel's seq_file in the Filesystem layer. This flaw allows a local attacker with a user privilege to gain access to out-of-bound memory, leading to a system crash, leak of internal kernel information and can escalate privileges. The issue results from not validating the size_t-to-int conversion prior to performing operations. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.

Statement: Any Red Hat product which relies on the Red Hat Enterprise Linux kernel is also potentially impacted. 
This includes layered products such as OpenShift Container Platform, OpenStack, Red Hat Virtualization, and others.

Affected upstream versions: n/a
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b
CVE-2021-33910: systemd: uncontrolled allocation on the stack in function unit_name_path_escape leads to crash
Component: systemd
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-07-20T12:00:00+00:00

A flaw was found in systemd. The use of alloca function with an uncontrolled size in function unit_name_path_escape allows a local attacker, able to mount a filesystem on a very long path, to crash systemd and the whole system by allocating a very large space in the stack. The highest threat from this vulnerability is to the system availability.

Statement: This issue did not affect the versions of systemd as shipped with Red Hat Enterprise Linux 7 as they did not use strdupa to duplicate strings in unit_name_path_escape function, but strdup, which allocates space on the heap.

Further, any Red Hat product which is supported on the Red Hat Enterprise Linux platform is also potentially impacted. This includes:
* Product containers which are based on the RHEL or UBI container images.  These images are updated regularly, and container health indicating whether a fix to this flaw is available can be seen in the Container Health Index, part of the Red Hat Container Catalog (https://access.redhat.com/containers).  In addition, any customer containers should be manually rebuilt when the base images are updated.
* Products which pull packages from the RHEL channel.  Please ensure that the underlying Red Hat Enterprise Linux systemd package is current in these product environments.

Affected upstream versions: n/a
Fixed upstream versions: v250
Upstream repository: https://github.com/systemd/systemd
Upstream fix commit: 441e0115646d54f080e5c3bb0ba477c892861ab9
CVE-2021-3429: cloud-init: randomly generated passwords logged in clear-text to world-readable file
Component: cloud-init
Severity: Moderate
CWE: CWE-532 (Insertion of Sensitive Information into Log File)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-03-23T00:00:00+00:00

A flaw was found in cloud-init. When a system is configured through cloud-init and the "Set Passwords" module is used with "chpasswd" directive and "RANDOM", the randomly generated password for the relative user is written in clear-text in a file readable by any existing user of the system. The highest threat from this vulnerability is to data confidentiality and it may allow a local attacker to log in as another user.

Statement: By default the randomly password generated by "chpasswd" must be changed on the first login of the user. That means that once a user accesses the system for the first time, the random password in the log file cannot be used anymore. However it is possible to configure an extended validity period for the random password, thus the actual impact of this password leak may vary based on the environment and how the systems are configured through cloud-init.

Affected upstream versions: <= 21.1
Fixed upstream versions: 21.2
Upstream repository: https://github.com/canonical/cloud-init
Upstream fix commit: b794d426b9ab43ea9d6371477466070d86e10668
CVE-2021-3444: kernel: bpf verifier incorrect mod32 truncation
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-02-13T00:00:00+00:00

An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF script uses mod32 destination register truncation when the source register was known to be 0. This flaw allows a local user to crash the system or possibly escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: This flaw is rated as having Moderate impact because of the need to have elevated privileges or non-standard configuration for running BPF script.

Affected upstream versions: trunk < 5.12-rc1, 5.11 < 5.11.2, 5.10 < 5.10.19, 5.4 < 5.4.101
Fixed upstream versions: 5.10.19, 5.11.2, 5.12-rc1, 5.4.101
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 9b00f1b78809
CVE-2021-3449: openssl: NULL pointer dereference in signature_algorithms processing
Component: openssl
Severity: Important
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-03-25T00:00:00+00:00

A flaw was found in openssl. A server crash and denial of service attack could occur if a client sends a TLSv1.2 renegotiation ClientHello and omits the signature_algorithms extension but includes a signature_algorithms_cert extension. The highest threat from this vulnerability is to system availability.

Statement: This flaw only affects OpenSSL 1.1.1, older versions are not affected.

Affected upstream versions: Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j)
Fixed upstream versions: OpenSSL_1_1_1k
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: fb9fa6b51defd48157eeb207f52181f735d96148
CVE-2021-3450: openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT
Component: openssl
Severity: Important
CWE: CWE-295 (Improper Certificate Validation)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2021-03-25T00:00:00+00:00

A flaw was found in openssl. The flag that enables additional security checks of certificates present in a certificate chain was not enabled allowing a confirmation step to verify that certificates in the chain are valid CA certificates is bypassed. The highest threat from this vulnerability is to data confidentiality and integrity.

Statement: This flaw affects openssl  1.1.1h  and above only, older versions are not affected by this flaw.

Affected upstream versions: Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j)
Fixed upstream versions: OpenSSL_1_1_1k
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 2a40b7bc7b94dd7de897a74571e7024f0cf0d63b
CVE-2021-3472: xorg-x11-server: XChangeFeedbackControl integer underflow leads to privilege escalation
Component: xorg-x11-server
Severity: Important
CWE: CWE-191 (Integer Underflow (Wrap or Wraparound))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-04-13T14:00:00+00:00

A flaw was found in xorg-x11-server. An interger underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Xorg server does not run with root  privileges in Red Hat Enterprise Linux 8, therefore this flaw has been rated as having moderate impact for Red Hat Enterprise linux 8.

Affected upstream versions: xorg-x11-server 1.20.11
Fixed upstream versions: xorg-server-21.0.99.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 7aaf54a1884f71dc363f0b884e57bcb67407a6cd
CVE-2021-34866: kernel: eBPF verification flaw
Component: kernel
Severity: Moderate
CWE: CWE-697 (Incorrect Comparison)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-10-13T12:00:00+00:00

A vulnerability was found in Linux Kernel, where a type confusion problem in check_map_func_compatibility() may lead to free arbitrary kernel memory.


Affected upstream versions: 5.14-rc3
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
Upstream fix commit: 5b029a32cfe4600f5e10e36b41778506b90fd4de
CVE-2021-3489: kernel: Linux kernel eBPF RINGBUF map oversized allocation
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-05-11T00:00:00+00:00

A flaw out of bound memory write in the Linux kernel BPF subsystem was found in the way user writes to BPF ring buffer too fast, so larger buffer than available memory could be allocated. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.


Affected upstream versions: trunk < v5.13-rc4, linux-5.12.y < v5.12.4, linux-5.11.y < v5.11.21, linux-5.10.y < v5.10.37, v5.8 < 5.8*
Fixed upstream versions: 5.8*, v5.10.37, v5.11.21, v5.12.4, v5.13-rc4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
Upstream fix commit: 4b81ccebaeee885ab1aa1438133f2991e3a2b6ea
CVE-2021-3501: kernel: userspace applications can misuse the KVM API to cause a write of 16 bytes at an offset up to 32 GB from vcpu->run
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2021-04-13T09:30:00+00:00

A flaw was found in the Linux kernel. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.

Statement: This issue affected Linux kernel versions as shipped with Red Hat Enterprise Linux 8 starting with RHEL-8.4.0 and onward kernel version.

Affected upstream versions: Linux kernel 5.12
Fixed upstream versions: v5.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 04c4f2ee3f68c9a4bf1653d15f1a9a435ae33f7a
CVE-2021-35065: glob-parent: Regular Expression Denial of Service
Component: glob-parent
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-12-26T00:00:00+00:00

A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.

Statement: The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.

Affected upstream versions: n/a
Fixed upstream versions: v6.0.1
Upstream repository: https://github.com/gulpjs/glob-parent
Upstream fix commit: 3e9f04a3b4349db7e1962d87c9a7398cda51f339
CVE-2021-3509: ceph-dashboard: Cross-site scripting via token Cookie
Component: ceph-dashboard
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-05-13T00:00:00+00:00

A flaw was found in the Red Hat Ceph Storage Dashboard. In response to CVE-2020-27839, the JWT token was moved  from localStorage to an httpOnly cookie. However, token cookies are used in the body  of the HTTP response for the documentation, which again makes it available to XSS. The greatest threat to the system is for confidentiality, integrity, and availability.

Statement: Red Hat OpenStack Platform deployments use the ceph package directly from the Ceph channel; the RHOSP package will not be updated at this time.
Red Hat OpenShift Container Storage (RHOCS) 4 shipped ceph package for the usage of RHOCS 4.2 only which has reached End of Life. The shipped version of ceph package is neither used nor supported with the release of RHOCS 4.3.

Red Hat Ceph Storage (RHCS) 4 ships a version of ceph which has not been patched for CVE-2020-27839, and therefore, although not vulnerable to this specific flaw, would be vulnerable if CVE-2020-27839 were to be patched without recognition of the flaw.

Red Hat Enterprise Linux 8 is not affected by this flaw as it does not include the ceph dashboard component.

Affected upstream versions: as shipped in Red Hat Ceph Storage 4
Fixed upstream versions: v14.2.21
Upstream repository: https://github.com/ceph/ceph
Upstream fix commit: adda853e64bdba1288d46bc7d462d23d8f2f10ca
CVE-2021-3516: libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c
Component: libxml2
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-04-21T00:00:00+00:00

There's a flaw in libxml2's xmllint. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

Statement: The only known exploitation path of this flaw is via the xmllint tool.

This flaw is out of support scope for Red Hat Enterprise Linux 6 and 7. To learn more about Red Hat Enterprise Linux support life cycles, please see https://access.redhat.com/support/policy/updates/errata .

Affected upstream versions: libxml2 2.9.11
Fixed upstream versions: v2.9.11
Upstream repository: https://gitlab.gnome.org/GNOME/libxml2
Upstream fix commit: 1358d157d0bd83be1dfe356a69213df9fac0b539
CVE-2021-3521: rpm: RPM does not require subkeys to have a valid binding signature
Component: rpm
Severity: Moderate
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N)
Public date: 2021-09-28T00:00:00+00:00

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature."[1] RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity.

1. https://tools.ietf.org/html/rfc4880#section-5.2.1

Statement: To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key.  It is strongly recommended to only use RPMs and public keys from trusted sources.

Affected upstream versions: Fixed in rpm-4.18.0-beta1, rpm-4.18.0-alpha2, rpm-4.18.0-alpha1 .
Fixed upstream versions: rpm-4.18.0-release
Upstream repository: https://github.com/rpm-software-management/rpm
Upstream fix commit: bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8
CVE-2021-3573: kernel: use-after-free in function hci_sock_bound_ioctl()
Component: kernel
Severity: Moderate
CWE: CWE-788 (Access of Memory Location After End of Buffer)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-06-08T00:00:00+00:00

A flaw use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system.

Statement: This issue is rated as having a Moderate impact because of the privileges (CAP_NET_ADMIN in initial namespace) required for exploiting the issue.

Affected upstream versions: kernel 5.13-rc5
Fixed upstream versions: v5.13
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git
Upstream fix commit: e305509e678b3a4af2b3cfd410f409f7cdaabb52
CVE-2021-35938: rpm: races with chown/chmod/capabilities calls during installation
Component: rpm
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 6.5 (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-06-30T00:00:00+00:00

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: System and service accounts may have the required permissions to exploit this flaw. Conversely, regular user accounts should not be allowed to manipulate RPM artifacts during installation, thus reducing the attack surface and hence the impact of this flaw considerably.

Affected upstream versions: Fixed in rpm v4.18.0
Fixed upstream versions: rpm-4.18.0-release
Upstream repository: https://github.com/rpm-software-management/rpm
Upstream fix commit: 25a435e90844ea98fe5eb7bef22c1aecf3a9c033
CVE-2021-35939: rpm: checks for unsafe symlinks are not performed for intermediary directories
Component: rpm
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 6.5 (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-06-30T00:00:00+00:00

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: System and service accounts may have the required permissions to exploit this flaw. Conversely, regular user accounts should not be allowed to manipulate RPM artifacts during installation, thus reducing the attack surface and hence the impact of this flaw considerably.

Affected upstream versions: Fixed in RPM-v4.18
Fixed upstream versions: rpm-4.18.0-release
Upstream repository: https://github.com/rpm-software-management/rpm
Upstream fix commit: 96ec957e281220f8e137a2d5eb23b83a6377d556