Full Disclosure mailing list archives
Re: Anomaly in Fedora `dnf update`: md5 mismatch of result
From: Michael Lazin <microlaser () gmail com>
Date: Tue, 15 Aug 2023 13:35:02 -0400
I would test it using sha256 instead of md5 before you jump to conclusions but dnf doesn't use https by default and you need to jump through hoops to get it working. I would say if you are a fedora user open a feature request for https for dnf with the fedora team if you can repeat this with sha256. Peace, Michael On Tue, Aug 15, 2023, 1:25 PM Georgi Guninski <gguninski () gmail com> wrote:
In short, I found anomaly in Fedora 37 and would like to know if it is vulnerability. As root type in terminal: dnf update If there is kernel update, watch stdout and stderr for: ##On Mon Aug 14 05:33:29 AM UTC 2023 (2/6): kernel-6.4.10-100.fc37.x86_64.rpm 1.2 MB/s | 140 kB 00:00 /var/cache/dnf/updates-fd4d3d0d1c34d49a/packages/kernel-modules-extra-6.4.9-100.fc37_6.4.10-100.fc37.x86_64.drpm: md5 mismatch of result ##$ md5sum /var/cache/dnf/updates-fd4d3d0d1c34d49a/packages/kernel-modules-extra-6.4.9-100.fc37_6.4.10-100.fc37.x86_64.drpm 356ea04e06bd58db4a15c64e64432f1a /var/cache/dnf/updates-fd4d3d0d1c34d49a/packages/kernel-modules-extra-6.4.9-100.fc37_6.4.10-100.fc37.x86_64.drpm Another possible approach: install Fedora 37 in VM without internet access and then do `dnf update` (haven't tested this yet). After second download, the kernel update passes, but I don't understand why the second download via http://mirror should pass. Examining the dnf source is option. Open problem: Can this be vulnerability, possibly assuming hostile mirror or network? Also, isn't md5 deprecated and known to suck much? -- guninski https://www.guninski.com/me.html _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Current thread:
- Anomaly in Fedora `dnf update`: md5 mismatch of result Georgi Guninski (Aug 15)
- Re: Anomaly in Fedora `dnf update`: md5 mismatch of result Adrean Boyadzhiev (Aug 19)
- Re: Anomaly in Fedora `dnf update`: md5 mismatch of result Matthew Fernandez (Aug 19)
- Re: Anomaly in Fedora `dnf update`: md5 mismatch of result Michael Lazin (Aug 19)
- Re: Anomaly in Fedora `dnf update`: md5 mismatch of result Jeffrey Walton (Aug 19)