A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rpm-build-libsUpgrade rpm-plugin-syslogUpgrade rpm-signUpgrade rpm-plugin-selinuxUpgrade rpm-buildUpgrade rpm-plugin-imaUpgrade rpm-plugin-prioresetUpgrade rpm-cronUpgrade rpm-apidocsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-develUpgrade rpm-plugin-fapolicydUpgrade rpm-libsUpgrade rpmUpgrade python3-rpm | May 4, 2022 | Mar 26, 2021 |
| Alpine Linux | — | Upgrade rpm | Aug 22, 2024 | Mar 26, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rpm-build-libsUpgrade rpmUpgrade rpm-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade python2-rpmUpgrade rpm-signUpgrade rpm-develUpgrade python3-rpmUpgrade rpm-buildUpgrade rpm-cronUpgrade rpm-libsUpgrade rpm-apidocs | Jul 19, 2021 | Mar 26, 2021 |
| Amazon_linux | — | Upgrade rpm | Jul 13, 2021 | Mar 26, 2021 |
| Centos_linux | — | Upgrade rpm-buildUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-ima-debuginfoUpgrade rpmUpgrade python3-rpm-debuginfoUpgrade rpm-apidocsUpgrade rpm-debuginfoUpgrade rpm-pythonUpgrade rpm-plugin-syslogUpgrade rpm-plugin-fapolicydUpgrade rpm-devel-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-libs-debuginfoUpgrade rpm-develUpgrade rpm-cronUpgrade rpm-plugin-prioresetUpgrade rpm-build-libsUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-selinuxUpgrade rpm-signUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-libsUpgrade rpm-plugin-systemd-inhibitUpgrade python3-rpmUpgrade rpm-debugsourceUpgrade rpm-sign-debuginfoUpgrade rpm-build-debuginfo | Jun 30, 2021 | Mar 26, 2021 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | Mar 26, 2021 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Jul 21, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rpm-libsUpgrade rpmUpgrade rpm-pythonUpgrade rpm-develUpgrade rpm-buildUpgrade rpm-build-libsUpgrade rpm-sign | Sep 16, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rpm-develUpgrade rpm-signUpgrade rpm-pythonUpgrade rpm-build-libsUpgrade rpm-buildUpgrade rpm-libsUpgrade rpm | Oct 26, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rpm-signUpgrade rpm-buildUpgrade rpm-build-libsUpgrade rpm-libsUpgrade rpm-pythonUpgrade rpmUpgrade rpm-devel | Sep 7, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-rpmUpgrade rpm-signUpgrade rpm-cronUpgrade rpm-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-develUpgrade rpm-plugin-prioresetUpgrade rpm-buildUpgrade python2-rpmUpgrade rpm-plugin-imaUpgrade rpm-sign-libsUpgrade rpm-plugin-syslogUpgrade rpm-apidocsUpgrade rpmUpgrade rpm-plugin-selinuxUpgrade rpm-build-libs | Jun 28, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rpm-libsUpgrade rpmUpgrade python3-rpm | Aug 10, 2021 | Mar 26, 2021 |
| Ibm Aix | — | Apply the fix or workaround for rpm_advisory | Oct 12, 2022 | Mar 26, 2021 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle_linux | — | Upgrade rpm-libsUpgrade rpm-pythonUpgrade rpm-develUpgrade rpm-plugin-systemd-inhibitUpgrade python3-rpmUpgrade rpm-cronUpgrade rpmUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-selinuxUpgrade rpm-signUpgrade rpm-apidocsUpgrade rpm-plugin-syslogUpgrade rpm-buildUpgrade rpm-build-libsUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-ima | Jun 30, 2021 | Mar 11, 2021 |
| Redhat_linux | — | Upgrade rpm-debugsourceNo solution existsUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-selinux-debuginfoUpgrade python3-rpm-debuginfoUpgrade rpm-develUpgrade rpm-sign-debuginfoUpgrade rpm-apidocsUpgrade rpm-libs-debuginfoUpgrade rpm-pythonUpgrade rpm-build-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-prioresetUpgrade rpmUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-cronUpgrade rpm-signUpgrade rpm-plugin-fapolicydUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-debuginfoUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-build-debuginfoUpgrade rpm-libsUpgrade python3-rpmUpgrade rpm-devel-debuginfoUpgrade rpm-buildUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-syslog | Jun 30, 2021 | Mar 26, 2021 |
| Rocky_linux | — | Upgrade rpm-sign-debuginfoUpgrade rpm-build-libsUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-prioresetUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-libsUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-imaUpgrade rpm-build-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-syslogUpgrade python3-rpmUpgrade rpm-develUpgrade rpm-plugin-fapolicydUpgrade rpm-debugsourceUpgrade rpmUpgrade rpm-build-libs-debuginfoUpgrade rpm-buildUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-signUpgrade rpm-plugin-prioreset-debuginfo | May 5, 2022 | Mar 26, 2021 |
| Suse | — | Upgrade python3-rpmUpgrade libdnf2Upgrade rpm-32bitUpgrade rpm-ndb-32bitUpgrade python3-hawkeyUpgrade hawkey-manUpgrade python2-rpmUpgrade rpm-pythonUpgrade python3-libdnfUpgrade librepo0Upgrade rpm-buildUpgrade rpm-ndbUpgrade python3-librepoUpgrade libdnf-repo-config-zyppUpgrade libdnf-develUpgrade rpmUpgrade rpm-develUpgrade librepo-devel | Aug 14, 2021 | Mar 26, 2021 |
| Ubuntu | — | Upgrade librpmio8 (Ubuntu Pro)Upgrade librpmio3 (Ubuntu Pro)Upgrade librpm8 (Ubuntu Pro)Upgrade rpm (Ubuntu Pro)Upgrade rpm-common (Ubuntu Pro)Upgrade librpmsign8 (Ubuntu Pro)Upgrade librpmsign3 (Ubuntu Pro)Upgrade librpmbuild8 (Ubuntu Pro)Upgrade librpmbuild3 (Ubuntu Pro)Upgrade librpm3 (Ubuntu Pro) | Mar 22, 2023 | Mar 26, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 26, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub