CVE-2012-6088: Rpm

Medium severity, CVSS 4.3. EPSS: 2.2% chance of exploitation in the next 30 days.

The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package.

Affected products

• Rpm Rpm: version 4.10.0 only; version 4.10.1 only

Published 2013-01-18. Last modified 2026-06-16.