7

CVE-2021-20271

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

Data is provided by the National Vulnerability Database (NVD)
Rpm ≫ Rpm Version >= 4.15.0 < 4.15.1.3
Rpm ≫ Rpm Version >= 4.16.0 < 4.16.1.3
Rpm ≫ Rpm Version4.15.0 Updatealpha
Rpm ≫ Rpm Version4.15.0 Updatebeta1
Rpm ≫ Rpm Version4.15.0 Updaterc1
Rpm ≫ Rpm Version4.16.0 Updatealpha
Rpm ≫ Rpm Version4.16.0 Updatebeta2
Rpm ≫ Rpm Version4.16.0 Updatebeta3
Rpm ≫ Rpm Version4.16.0 Updaterc1
Redhat ≫ Enterprise Linux Version8.0
Fedoraproject ≫ Fedora Version32
Fedoraproject ≫ Fedora Version33
Fedoraproject ≫ Fedora Version34
Starwindsoftware ≫ Starwind Virtual San Versionv8 Updatebuild14398
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.2% 0.42
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7 1 5.9
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 5.1 4.9 6.4
AV:N/AC:H/Au:N/C:P/I:P/A:P
CWE-345 Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

https://bugzilla.redhat.com/show_bug.cgi?id=1934125
Patch
Third Party Advisory
Issue Tracking