A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rpm-signUpgrade rpm-plugin-prioresetUpgrade rpm-build-libsUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-syslogUpgrade rpm-buildUpgrade rpm-plugin-imaUpgrade rpm-cronUpgrade rpm-libsUpgrade python3-rpmUpgrade rpm-develUpgrade rpm-apidocsUpgrade rpm-plugin-systemd-inhibitUpgrade rpmUpgrade rpm-plugin-fapolicyd | May 4, 2022 | Mar 26, 2021 |
| Alpine Linux | — | Upgrade rpm | Aug 22, 2024 | Mar 26, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rpm-buildUpgrade rpm-apidocsUpgrade python3-rpmUpgrade rpm-libsUpgrade rpm-cronUpgrade rpm-develUpgrade rpm-signUpgrade rpmUpgrade rpm-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-build-libsUpgrade python2-rpm | Jul 19, 2021 | Mar 26, 2021 |
| Amazon_linux | — | Upgrade rpm | Jul 13, 2021 | Mar 26, 2021 |
| Centos_linux | — | Upgrade rpm-devel-debuginfoUpgrade python3-rpm-debuginfoUpgrade rpm-pythonUpgrade rpm-debuginfoUpgrade rpm-buildUpgrade rpm-develUpgrade rpm-libs-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-apidocsUpgrade rpm-plugin-syslogUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-imaUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpmUpgrade rpm-cronUpgrade python3-rpmUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-selinuxUpgrade rpm-build-debuginfoUpgrade rpm-build-libsUpgrade rpm-signUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-libsUpgrade rpm-build-libs-debuginfoUpgrade rpm-sign-debuginfoUpgrade rpm-debugsourceUpgrade rpm-plugin-prioreset-debuginfo | Jun 30, 2021 | Mar 26, 2021 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | Mar 26, 2021 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Jul 21, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rpmUpgrade rpm-pythonUpgrade rpm-develUpgrade rpm-libsUpgrade rpm-buildUpgrade rpm-build-libsUpgrade rpm-sign | Sep 16, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rpm-signUpgrade rpm-build-libsUpgrade rpm-pythonUpgrade rpm-develUpgrade rpm-libsUpgrade rpmUpgrade rpm-build | Oct 26, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rpm-signUpgrade rpm-pythonUpgrade rpmUpgrade rpm-libsUpgrade rpm-buildUpgrade rpm-build-libsUpgrade rpm-devel | Sep 7, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rpm-build-libsUpgrade rpm-apidocsUpgrade rpmUpgrade python2-rpmUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-syslogUpgrade rpm-plugin-selinuxUpgrade rpm-sign-libsUpgrade rpm-plugin-imaUpgrade rpm-buildUpgrade rpm-develUpgrade rpm-libsUpgrade rpm-plugin-systemd-inhibitUpgrade python3-rpmUpgrade rpm-cronUpgrade rpm-sign | Jun 28, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-rpmUpgrade rpmUpgrade rpm-libs | Aug 10, 2021 | Mar 26, 2021 |
| Ibm Aix | — | Apply the fix or workaround for rpm_advisory | Oct 12, 2022 | Mar 26, 2021 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle_linux | — | Upgrade rpm-develUpgrade python3-rpmUpgrade rpm-libsUpgrade rpm-pythonUpgrade rpm-plugin-systemd-inhibitUpgrade rpmUpgrade rpm-plugin-fapolicydUpgrade rpm-cronUpgrade rpm-plugin-prioresetUpgrade rpm-buildUpgrade rpm-plugin-selinuxUpgrade rpm-signUpgrade rpm-apidocsUpgrade rpm-plugin-imaUpgrade rpm-plugin-syslogUpgrade rpm-build-libs | Jun 30, 2021 | Mar 11, 2021 |
| Redhat_linux | — | Upgrade rpm-plugin-selinuxUpgrade rpm-plugin-prioresetNo solution existsUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-debugsourceUpgrade rpm-apidocsUpgrade rpm-sign-debuginfoUpgrade rpm-build-libsUpgrade rpm-develUpgrade rpm-libs-debuginfoUpgrade rpm-pythonUpgrade rpm-plugin-fapolicydUpgrade rpm-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-buildUpgrade rpm-cronUpgrade rpm-plugin-ima-debuginfoUpgrade rpmUpgrade python3-rpmUpgrade rpm-signUpgrade rpm-libsUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-build-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfo | Jun 30, 2021 | Mar 26, 2021 |
| Rocky_linux | — | Upgrade rpm-plugin-syslogUpgrade rpm-devel-debuginfoUpgrade rpm-build-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-libsUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-build-libsUpgrade rpm-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-sign-debuginfoUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-selinuxUpgrade rpm-libs-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-develUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-buildUpgrade rpmUpgrade rpm-plugin-prioreset-debuginfoUpgrade python3-rpmUpgrade rpm-debugsourceUpgrade rpm-signUpgrade rpm-plugin-systemd-inhibit | May 5, 2022 | Mar 26, 2021 |
| Suse | — | Upgrade python3-rpmUpgrade libdnf2Upgrade rpm-32bitUpgrade python3-hawkeyUpgrade hawkey-manUpgrade rpm-ndb-32bitUpgrade python2-rpmUpgrade librepo0Upgrade rpm-develUpgrade libdnf-repo-config-zyppUpgrade python3-librepoUpgrade rpm-buildUpgrade rpm-pythonUpgrade rpm-ndbUpgrade python3-libdnfUpgrade librepo-develUpgrade libdnf-develUpgrade rpm | Aug 14, 2021 | Mar 26, 2021 |
| Ubuntu | — | Upgrade librpmsign3 (Ubuntu Pro)Upgrade librpmbuild3 (Ubuntu Pro)Upgrade librpm3 (Ubuntu Pro)Upgrade librpmbuild8 (Ubuntu Pro)Upgrade librpmsign8 (Ubuntu Pro)Upgrade librpm8 (Ubuntu Pro)Upgrade rpm-common (Ubuntu Pro)Upgrade rpm (Ubuntu Pro)Upgrade librpmio8 (Ubuntu Pro)Upgrade librpmio3 (Ubuntu Pro) | Mar 22, 2023 | Mar 26, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 26, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub