A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rpmUpgrade rpm-apidocsUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-systemd-inhibitUpgrade python3-rpmUpgrade rpm-libsUpgrade rpm-cronUpgrade rpm-develUpgrade rpm-plugin-imaUpgrade rpm-signUpgrade rpm-build-libsUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-syslogUpgrade rpm-buildUpgrade rpm-plugin-selinux | May 4, 2022 | Mar 26, 2021 |
| Alpine Linux | — | Upgrade rpm | Aug 22, 2024 | Mar 26, 2021 |
| Amazon Linux Ami 2 | — | Upgrade python3-rpmUpgrade rpm-cronUpgrade rpm-libsUpgrade rpm-buildUpgrade rpm-apidocsUpgrade rpm-build-libsUpgrade rpm-plugin-systemd-inhibitUpgrade python2-rpmUpgrade rpm-develUpgrade rpm-debuginfoUpgrade rpm-signUpgrade rpm | Jul 19, 2021 | Mar 26, 2021 |
| Amazon_linux | — | Upgrade rpm | Jul 13, 2021 | Mar 26, 2021 |
| Centos_linux | — | Upgrade rpm-apidocsUpgrade rpm-debuginfoUpgrade rpm-plugin-ima-debuginfoUpgrade rpmUpgrade rpm-plugin-fapolicydUpgrade rpm-pythonUpgrade python3-rpm-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-develUpgrade rpm-plugin-imaUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-buildUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-libsUpgrade rpm-build-libs-debuginfoUpgrade rpm-build-debuginfoUpgrade python3-rpmUpgrade rpm-debugsourceUpgrade rpm-sign-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-signUpgrade rpm-build-libsUpgrade rpm-cron | Jun 30, 2021 | Mar 26, 2021 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | Mar 26, 2021 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Jul 21, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rpm-pythonUpgrade rpm-develUpgrade rpm-libsUpgrade rpmUpgrade rpm-signUpgrade rpm-build-libsUpgrade rpm-build | Sep 16, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rpm-libsUpgrade rpmUpgrade rpm-buildUpgrade rpm-develUpgrade rpm-signUpgrade rpm-pythonUpgrade rpm-build-libs | Oct 26, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rpm-signUpgrade rpm-pythonUpgrade rpmUpgrade rpm-develUpgrade rpm-buildUpgrade rpm-build-libsUpgrade rpm-libs | Sep 7, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-rpmUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-develUpgrade rpm-signUpgrade rpm-libsUpgrade rpm-cronUpgrade rpmUpgrade rpm-sign-libsUpgrade rpm-buildUpgrade python2-rpmUpgrade rpm-plugin-selinuxUpgrade rpm-build-libsUpgrade rpm-plugin-imaUpgrade rpm-apidocsUpgrade rpm-plugin-syslogUpgrade rpm-plugin-prioreset | Jun 28, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-rpmUpgrade rpmUpgrade rpm-libs | Aug 10, 2021 | Mar 26, 2021 |
| Ibm Aix | — | Apply the fix or workaround for rpm_advisory | Oct 12, 2022 | Mar 26, 2021 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle_linux | — | Upgrade python3-rpmUpgrade rpm-pythonUpgrade rpm-plugin-fapolicydUpgrade rpm-develUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-cronUpgrade rpm-libsUpgrade rpmUpgrade rpm-plugin-selinuxUpgrade rpm-buildUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-syslogUpgrade rpm-plugin-imaUpgrade rpm-signUpgrade rpm-apidocsUpgrade rpm-build-libs | Jun 30, 2021 | Mar 11, 2021 |
| Redhat_linux | — | Upgrade rpm-plugin-syslog-debuginfoUpgrade rpm-build-debuginfoUpgrade rpmUpgrade rpm-buildUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-libsUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-cronUpgrade python3-rpmUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-devel-debuginfoUpgrade rpm-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-signUpgrade rpm-plugin-syslogUpgrade rpm-sign-debuginfoUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-build-libsUpgrade rpm-pythonUpgrade rpm-debugsourceUpgrade rpm-develUpgrade rpm-apidocsUpgrade rpm-libs-debuginfoUpgrade python3-rpm-debuginfoNo solution existsUpgrade rpm-plugin-selinux-debuginfo | Jun 30, 2021 | Mar 26, 2021 |
| Rocky_linux | — | Upgrade rpmUpgrade rpm-signUpgrade rpm-debugsourceUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-buildUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-develUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-plugin-fapolicydUpgrade python3-rpmUpgrade rpm-plugin-syslogUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-plugin-prioresetUpgrade rpm-build-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-build-libsUpgrade rpm-libsUpgrade rpm-sign-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-debuginfoUpgrade rpm-plugin-selinuxUpgrade python3-rpm-debuginfoUpgrade rpm-libs-debuginfo | May 5, 2022 | Mar 26, 2021 |
| Suse | — | Upgrade rpm-32bitUpgrade python3-rpmUpgrade rpm-ndb-32bitUpgrade hawkey-manUpgrade libdnf2Upgrade python3-hawkeyUpgrade libdnf-repo-config-zyppUpgrade python3-libdnfUpgrade librepo0Upgrade rpm-develUpgrade python3-librepoUpgrade librepo-develUpgrade rpm-pythonUpgrade python2-rpmUpgrade libdnf-develUpgrade rpmUpgrade rpm-buildUpgrade rpm-ndb | Aug 14, 2021 | Mar 26, 2021 |
| Ubuntu | — | Upgrade librpm3 (Ubuntu Pro)Upgrade librpmsign3 (Ubuntu Pro)Upgrade librpmbuild8 (Ubuntu Pro)Upgrade librpmbuild3 (Ubuntu Pro)Upgrade librpmio3 (Ubuntu Pro)Upgrade rpm (Ubuntu Pro)Upgrade librpmsign8 (Ubuntu Pro)Upgrade librpm8 (Ubuntu Pro)Upgrade librpmio8 (Ubuntu Pro)Upgrade rpm-common (Ubuntu Pro) | Mar 22, 2023 | Mar 26, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 26, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub