p PatchFirst

CVE-2021-20271

CVE-2021-20271

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

CVSS 7.0 · High · EPSS 0.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • rpm

    Versions
    • all versions: Affected

    No fix published

  • rpm Debian:12

    Affected ranges
    • ECOSYSTEM: < 4.16.1.2+dfsg1-1

    Update to 4.16.1.2+dfsg1-1

  • rpm Debian:13

    Affected ranges
    • ECOSYSTEM: < 4.16.1.2+dfsg1-1

    Update to 4.16.1.2+dfsg1-1

  • rpm Debian:14

    Affected ranges
    • ECOSYSTEM: < 4.16.1.2+dfsg1-1

    Update to 4.16.1.2+dfsg1-1

  • rpm Ubuntu:Pro:14.04:LTS

    Versions
    • 4.11.1-2
    • 4.11.1-3
    • 4.11.1-3ubuntu0.1
    • 4.11.1-3ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rpm Ubuntu:Pro:16.04:LTS

    Versions
    • 4.12.0.1+dfsg1-3build2
    • 4.12.0.1+dfsg1-3build3
    Affected ranges
    • ECOSYSTEM: < 4.12.0.1+dfsg1-3ubuntu0.1~esm1

    Update to 4.12.0.1+dfsg1-3ubuntu0.1~esm1

  • rpm Ubuntu:Pro:18.04:LTS

    Versions
    • 4.12.0.2+dfsg1-2build2
    • 4.14.0+dfsg1-2
    • 4.14.1+dfsg1-2
    Affected ranges
    • ECOSYSTEM: < 4.14.1+dfsg1-2ubuntu0.1~esm1

    Update to 4.14.1+dfsg1-2ubuntu0.1~esm1

  • rpm Ubuntu:Pro:20.04:LTS

    Versions
    • 4.14.2.1+dfsg1-1
    • 4.14.2.1+dfsg1-1build1
    • 4.14.2.1+dfsg1-1build2
    Affected ranges
    • ECOSYSTEM: < 4.14.2.1+dfsg1-1ubuntu0.1~esm1

    Update to 4.14.2.1+dfsg1-1ubuntu0.1~esm1

Original sources

Check your server →