PT-2022-7386 · Rpm+8 · Rpm+8

Demi M. Obenour + 1 · Published 2021-08-15 · Updated 2024-06-15 · CVE-2021-3521

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions RPM (affected versions not specified)

Description The issue is related to a flaw in RPM's signature functionality, where OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. This could allow an attacker to add a malicious subkey to a legitimate public key, causing RPM to wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

ALSA-2022:0368

ALT-PU-2021-2518

ALT-PU-2021-2600

AZL-10637

BDU:2024-04926

CESA-2022_0368

CVE-2021-3521

MGASA-2022-0321

OESA-2021-1431

OPENSUSE-SU-2024:12245-1

OPENSUSE-SU-2024_1557-1

OPENSUSE-SU-2024_1557-2

RHSA-2022:0254

RHSA-2022:0368

RHSA-2022:0634

RHSA-2022_0368

RLSA-2022:0368

SUSE-SU-2024:1557-1

SUSE-SU-2024:1557-2

SUSE-SU-2024:1557-3

SUSE-SU-2024_1557-1

SUSE-SU-2024_1557-2

Affected Products

Alt Linux

Almalinux

Centos

Debian

Rpm

Red Hat

Red Os

Rocky Linux

Suse

References · 40

• https://github.com/rpm-software-management/rpm/commit/bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:1557-3 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3521 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:0368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3521 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0321 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-0368.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1431 · Vendor Advisory
• https://github.com/rpm-software-management/rpm/pull/1795 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1941098 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3521 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-10637 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04926 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:1557-2 · Vendor Advisory
• https://security.gentoo.org/glsa/202210-22 · Vendor Advisory