Re: Pacman package manager - taking untrusted input

["jellicent () protonmail com" <jellicent () protonmail com>]

On Tuesday, April 21, 2020 5:21 PM, Amin Vakil <info () aminvakil com> wrote:
> Although this is something that can be fixed, it's not a critical
> security issue at all, in all scenarios that has been written if
> database is compromised, the best (worst) thing that malicious actor can
> do is stopping user from installing packages, because he can't create a
> verified gpg signed package which is mandatory for pacman to allow
> installation of the package.

This is incorrect. An attacker need only find a bug in how Pacman does
parsing/reading of the database file to potentially get code execution
on the box as root. See Pacman's CVE history for at least one example
of this. The problem happens before any package signatures come into
play.