CVE-2021-20271
Severity
7.0HIGH
EPSS
0.2%
top 54.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 26
Latest updateJul 21
Description
A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9
Affected Packages5 packages
Also affects: Fedora 32, 33, 34, Enterprise Linux 8.0
Patches
🔴Vulnerability Details
4GHSA▶
GHSA-77pm-gxx7-5c5f: A flaw was found in RPM's signature check functionality when reading a package file↗2022-05-24
CVEList▶
CVE-2021-20271: A flaw was found in RPM's signature check functionality when reading a package file↗2021-03-26
OSV▶
CVE-2021-20271: A flaw was found in RPM's signature check functionality when reading a package file↗2021-03-26
📋Vendor Advisories
4Microsoft▶
A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package whose signature he↗2021-03-09
Debian▶
CVE-2021-20271: rpm - A flaw was found in RPM's signature check functionality when reading a package f...↗2021