A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rpm | Aug 22, 2024 | May 19, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rpm-build-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-libsUpgrade python3-rpmUpgrade rpm-signUpgrade rpm-develUpgrade rpmUpgrade rpm-cronUpgrade rpm-apidocsUpgrade rpm-buildUpgrade python2-rpmUpgrade rpm-debuginfo | Jul 19, 2021 | May 19, 2021 |
| Amazon_linux | — | Upgrade rpm | Jul 13, 2021 | May 19, 2021 |
| Centos_linux | — | Upgrade rpm-plugin-selinux-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-apidocsUpgrade rpm-plugin-syslogUpgrade rpm-cronUpgrade rpm-buildUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-libsUpgrade rpm-plugin-fapolicydUpgrade rpm-devel-debuginfoUpgrade rpm-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-selinuxUpgrade python3-rpm-debuginfoUpgrade rpm-develUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-sign-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-debugsourceUpgrade rpm-plugin-syslog-debuginfoUpgrade python3-rpmUpgrade rpm-signUpgrade rpm-build-debuginfoUpgrade rpmUpgrade rpm-build-libsUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-prioreset | Sep 10, 2021 | May 19, 2021 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | May 19, 2021 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Jul 21, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rpm-build-libsUpgrade rpm-develUpgrade rpm-signUpgrade rpmUpgrade rpm-pythonUpgrade rpm-libsUpgrade rpm-build | Sep 16, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rpm-pythonUpgrade rpmUpgrade rpm-develUpgrade rpm-signUpgrade rpm-build-libsUpgrade rpm-buildUpgrade rpm-libs | Oct 26, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rpm-libsUpgrade rpm-pythonUpgrade rpm-build-libsUpgrade rpm-develUpgrade rpm-buildUpgrade rpmUpgrade rpm-sign | Sep 7, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rpm-plugin-imaUpgrade rpm-plugin-selinuxUpgrade rpm-signUpgrade rpm-plugin-prioresetUpgrade python3-rpmUpgrade rpm-cronUpgrade rpm-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpmUpgrade rpm-buildUpgrade rpm-sign-libsUpgrade rpm-build-libsUpgrade python2-rpmUpgrade rpm-apidocsUpgrade rpm-plugin-syslogUpgrade rpm-devel | Jun 28, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rpmUpgrade python3-rpmUpgrade rpm-libs | Aug 10, 2021 | May 19, 2021 |
| Ibm Aix | — | Apply the fix or workaround for rpm_advisory | Oct 12, 2022 | May 19, 2021 |
| Redhat_linux | — | Upgrade rpm-plugin-systemd-inhibitUpgrade rpm-libs-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-apidocsUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-develNo solution existsUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-debugsourceUpgrade rpm-build-libsUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-debuginfoUpgrade rpm-sign-debuginfoUpgrade rpm-build-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-cronUpgrade rpm-devel-debuginfoUpgrade rpmUpgrade python3-rpmUpgrade rpm-libsUpgrade rpm-plugin-imaUpgrade python3-rpm-debuginfoUpgrade rpm-signUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-fapolicydUpgrade rpm-build | Sep 10, 2021 | May 19, 2021 |
| Rocky_linux | — | Upgrade rpm-build-libs-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-buildUpgrade rpm-plugin-imaUpgrade python3-rpmUpgrade rpmUpgrade rpm-build-debuginfoUpgrade rpm-debugsourceUpgrade rpm-libsUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-signUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-libs-debuginfoUpgrade rpm-develUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-sign-debuginfoUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade python3-rpm-debuginfoUpgrade rpm-debuginfoUpgrade rpm-build-libsUpgrade rpm-plugin-systemd-inhibit-debuginfo | May 5, 2022 | May 19, 2021 |
| Suse | — | Upgrade rpm-ndbUpgrade rpm-buildUpgrade rpm-pythonUpgrade librepo0Upgrade rpmUpgrade librepo-develUpgrade libdnf-repo-config-zyppUpgrade python3-rpmUpgrade python2-rpmUpgrade hawkey-manUpgrade libdnf-develUpgrade python3-librepoUpgrade libdnf2Upgrade python3-hawkeyUpgrade rpm-ndb-32bitUpgrade rpm-32bitUpgrade python3-libdnfUpgrade rpm-devel | Aug 14, 2021 | May 19, 2021 |
| Ubuntu | — | Upgrade librpmbuild8 (Ubuntu Pro)Upgrade librpmsign3 (Ubuntu Pro)Upgrade librpm3 (Ubuntu Pro)Upgrade librpmsign8 (Ubuntu Pro)Upgrade librpmio8 (Ubuntu Pro)Upgrade librpmio3 (Ubuntu Pro)Upgrade rpm-common (Ubuntu Pro)Upgrade rpm (Ubuntu Pro)Upgrade librpm8 (Ubuntu Pro)Upgrade librpmbuild3 (Ubuntu Pro) | Mar 22, 2023 | May 19, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 19, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub