Vulnerability in Rpm
CVE-2021-20271
A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.
EPSS: 0.008 (54.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Rpm — versions 4.15.0, 4.16.0
- Starwindsoftware Starwind_virtual_san — versions v8
- Fedoraproject Fedora — versions 32, 33, 34
- Redhat Enterprise_linux — versions 8.0
- N/a Rpm — versions all versions
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (Patch, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (Patch, Third Party Advisory)
- secalert@redhat.com (vendor-advisory)
- secalert@redhat.com (vendor-advisory)
- secalert@redhat.com (vendor-advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory)
- secalert@redhat.com (Third Party Advisory)
Frequently asked questions
- What is CVE-2021-20271?
- CVE-2021-20271 is a high-severity vulnerability in Rpm, classified under Insufficient Verification of Data Authenticity. CVSS score: 7.0/10. Published 2021-03-26.
- How severe is CVE-2021-20271?
- High severity. CVSS v3 base score is 7.0 out of 10.
- Is CVE-2021-20271 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.