PT-2021-6079 · Rpm+8 · Rpm+8

Demi Marie Obenour · Published 2021-03-11 · Updated 2023-02-12 · CVE-2021-20271

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RPM (affected versions not specified)

Description The issue is related to insufficient authentication of data in the RPM software's signature check functionality. This allows an attacker to potentially corrupt the RPM database and execute code by convincing a victim to install a modified package. The highest threat from this issue is to data integrity, confidentiality, and system availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2022-00716

CESA-2021_2574

CESA-2021_4785

CVE-2021-20271

MGASA-2021-0167

OESA-2021-1163

OPENSUSE-SU-2021:1366-1

OPENSUSE-SU-2021:2682-1

OPENSUSE-SU-2021:2685-1

OPENSUSE-SU-2021_1366-1

OPENSUSE-SU-2021_2682-1

OPENSUSE-SU-2021_2685-1

RHSA-2021:2574

RHSA-2021:2791

RHSA-2021:4771

RHSA-2021:4785

RHSA-2021:4975

RHSA-2021_2574

RHSA-2021_4785

RLSA-2021:2574

SUSE-SU-2021:2682-1

SUSE-SU-2021:3444-1

SUSE-SU-2022:3939-1

USN-5273-1

Affected Products

Astra Linux

Centos

Ibm Aix

Linuxmint

Rpm

Red Hat

Rocky Linux

Suse

Ubuntu

References · 67

• https://github.com/rpm-software-management/rpm/commit/d6a86b5e69e46cc283b1e06c92343319beb42e21 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILPBTPSBRYL4POBI3F4YUSVPSOQNJBY · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-20271 · Vendor Advisory
• https://security.gentoo.org/glsa/202107-43 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0167 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:2574 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TMGXO3W6DHPO62GJ4VVF5DEUX5DRUR5K · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:2574 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20271 · Security Note
• https://osv.dev/vulnerability/USN-5273-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1366-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3939-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1163 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHRPNBCRPDJHHQE3MBPSZK4H7X2IM7AC · Vendor Advisory