CVE-2021-20271

Katalog CVE

CVSS 7.0 · High EPSS 0,80%

Kerentanan Insufficient Verification of Data Authenticity pada rpm, redhat enterprise linux +2 lainnya. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

Rincian

Terbit di NVD

26 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,80% peluang dieksploitasi; lebih tinggi dari 55,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1934125 issue tracking · patch · advisory pihak ketiga
• https://github.com/rpm-software-management/rpm/commit/d6a86b5e69e46cc283b1e06c92343319beb42e21 patch · advisory pihak ketiga
• https://security.gentoo.org/glsa/202107-43 advisory pihak ketiga
• https://www.starwindsoftware.com/security/sw-20220805-0002/ advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMGXO3W6DHPO6...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHRPNBCRPDJHH...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILPBTPSBRYL4...