A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rpm-cronUpgrade rpmUpgrade rpm-libsUpgrade rpm-develUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-apidocsUpgrade python3-rpmUpgrade rpm-buildUpgrade rpm-build-libsUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-syslogUpgrade rpm-signUpgrade rpm-plugin-ima | May 4, 2022 | Mar 26, 2021 |
| Alpine Linux | — | Upgrade rpm | Aug 22, 2024 | Mar 26, 2021 |
| Amazon Linux Ami 2 | — | Upgrade python3-rpmUpgrade rpm-cronUpgrade rpm-buildUpgrade rpm-libsUpgrade rpm-apidocsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-debuginfoUpgrade rpm-develUpgrade rpm-build-libsUpgrade python2-rpmUpgrade rpm-signUpgrade rpm | Jul 19, 2021 | Mar 26, 2021 |
| Amazon_linux | — | Upgrade rpm | Jul 13, 2021 | Mar 26, 2021 |
| Centos_linux | — | Upgrade rpm-apidocsUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-buildUpgrade rpm-develUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpmUpgrade rpm-pythonUpgrade rpm-plugin-syslogUpgrade rpm-devel-debuginfoUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-prioresetUpgrade rpm-cronUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-build-libs-debuginfoUpgrade rpm-build-debuginfoUpgrade python3-rpmUpgrade rpm-signUpgrade rpm-plugin-selinuxUpgrade rpm-build-libsUpgrade rpm-debugsourceUpgrade rpm-sign-debuginfo | Jun 30, 2021 | Mar 26, 2021 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | Mar 26, 2021 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Jul 21, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rpmUpgrade rpm-develUpgrade rpm-pythonUpgrade rpm-libsUpgrade rpm-build-libsUpgrade rpm-buildUpgrade rpm-sign | Sep 16, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rpm-develUpgrade rpm-signUpgrade rpm-build-libsUpgrade rpm-pythonUpgrade rpm-buildUpgrade rpm-libsUpgrade rpm | Oct 26, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rpm-build-libsUpgrade rpm-libsUpgrade rpm-buildUpgrade rpm-signUpgrade rpmUpgrade rpm-pythonUpgrade rpm-devel | Sep 7, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rpm-cronUpgrade rpm-plugin-systemd-inhibitUpgrade python3-rpmUpgrade rpm-develUpgrade rpm-libsUpgrade rpm-signUpgrade rpm-plugin-selinuxUpgrade rpm-build-libsUpgrade rpm-sign-libsUpgrade rpm-plugin-syslogUpgrade rpm-plugin-prioresetUpgrade rpm-apidocsUpgrade rpmUpgrade rpm-buildUpgrade rpm-plugin-imaUpgrade python2-rpm | Jun 28, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-rpmUpgrade rpmUpgrade rpm-libs | Aug 10, 2021 | Mar 26, 2021 |
| Ibm Aix | — | Apply the fix or workaround for rpm_advisory | Oct 12, 2022 | Mar 26, 2021 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle_linux | — | Upgrade rpm-cronUpgrade python3-rpmUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-develUpgrade rpmUpgrade rpm-plugin-fapolicydUpgrade rpm-libsUpgrade rpm-pythonUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-selinuxUpgrade rpm-signUpgrade rpm-apidocsUpgrade rpm-plugin-imaUpgrade rpm-buildUpgrade rpm-plugin-syslogUpgrade rpm-build-libs | Jun 30, 2021 | Mar 11, 2021 |
| Redhat_linux | — | Upgrade python3-rpm-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-sign-debuginfoUpgrade rpm-pythonUpgrade rpm-build-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-prioresetNo solution existsUpgrade rpm-apidocsUpgrade rpm-plugin-selinuxUpgrade rpm-debugsourceUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-develUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-plugin-syslogUpgrade rpm-cronUpgrade python3-rpmUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpmUpgrade rpm-signUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-libsUpgrade rpm-debuginfoUpgrade rpm-buildUpgrade rpm-build-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpm-devel-debuginfo | Jun 30, 2021 | Mar 26, 2021 |
| Rocky_linux | — | Upgrade rpm-buildUpgrade rpm-plugin-fapolicydUpgrade rpm-debugsourceUpgrade rpmUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-signUpgrade rpm-develUpgrade python3-rpmUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-debuginfoUpgrade rpm-libsUpgrade rpm-plugin-imaUpgrade rpm-sign-debuginfoUpgrade rpm-build-libsUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-selinuxUpgrade rpm-build-debuginfoUpgrade rpm-devel-debuginfoUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-plugin-systemd-inhibit-debuginfo | May 5, 2022 | Mar 26, 2021 |
| Suse | — | Upgrade python3-hawkeyUpgrade libdnf2Upgrade rpm-ndb-32bitUpgrade rpm-32bitUpgrade python3-rpmUpgrade hawkey-manUpgrade python3-libdnfUpgrade python2-rpmUpgrade python3-librepoUpgrade librepo-develUpgrade rpm-buildUpgrade rpm-pythonUpgrade libdnf-develUpgrade rpmUpgrade librepo0Upgrade rpm-develUpgrade libdnf-repo-config-zyppUpgrade rpm-ndb | Aug 14, 2021 | Mar 26, 2021 |
| Ubuntu | — | Upgrade librpmio8 (Ubuntu Pro)Upgrade librpmio3 (Ubuntu Pro)Upgrade librpm8 (Ubuntu Pro)Upgrade rpm-common (Ubuntu Pro)Upgrade rpm (Ubuntu Pro)Upgrade librpmsign8 (Ubuntu Pro)Upgrade librpmsign3 (Ubuntu Pro)Upgrade librpm3 (Ubuntu Pro)Upgrade librpmbuild3 (Ubuntu Pro)Upgrade librpmbuild8 (Ubuntu Pro) | Mar 22, 2023 | Mar 26, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 26, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub