CVE-2021-20271
26.03.2021, 17:15
A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.Enginsight
| Vendor | Product | Version |
|---|---|---|
| rpm | rpm | 4.15.0 ≤ 𝑥 < 4.15.1.3 |
| rpm | rpm | 4.16.0 ≤ 𝑥 < 4.16.1.3 |
| rpm | rpm | 4.15.0:alpha |
| rpm | rpm | 4.15.0:beta1 |
| rpm | rpm | 4.15.0:rc1 |
| rpm | rpm | 4.16.0:alpha |
| rpm | rpm | 4.16.0:beta2 |
| rpm | rpm | 4.16.0:beta3 |
| rpm | rpm | 4.16.0:rc1 |
| redhat | enterprise_linux | 8.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| rpm |
|
Common Weakness Enumeration
References