What is CVE-2021-41067?

CVE-2021-41067 is a high-severity vulnerability in Listary, classified under Improper Validation of Integrity Check Value. CVSS score: 7.5/10. Published 2021-12-14.

How severe is CVE-2021-41067?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2021-41067 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Listary

CVE-2021-41067

An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP-based connection. This can be exploited with MITM techniques. Together with the lack of package validation, it can lead to manipulation of update packages that can cause an installation of malicious content.

EPSS: 0.006 (43.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Listary
N/a — versions n/a

Weakness classification (CWE)

CWE-354 — Improper Validation of Integrity Check Value

Public proof-of-concept exploits

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (x_refsource_MISC)

Frequently asked questions

What is CVE-2021-41067?: CVE-2021-41067 is a high-severity vulnerability in Listary, classified under Improper Validation of Integrity Check Value. CVSS score: 7.5/10. Published 2021-12-14.
How severe is CVE-2021-41067?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2021-41067 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.