A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rpm-plugin-fapolicydUpgrade python3-rpmUpgrade rpm-apidocsUpgrade rpm-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpmUpgrade rpm-develUpgrade rpm-cronUpgrade rpm-plugin-prioresetUpgrade rpm-buildUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-syslogUpgrade rpm-signUpgrade rpm-plugin-imaUpgrade rpm-build-libs | May 4, 2022 | Mar 26, 2021 |
| Alpine Linux | — | Upgrade rpm | Aug 22, 2024 | Mar 26, 2021 |
| Amazon Linux Ami 2 | — | Upgrade rpm-apidocsUpgrade rpm-libsUpgrade python3-rpmUpgrade rpm-cronUpgrade rpm-buildUpgrade rpm-plugin-systemd-inhibitUpgrade python2-rpmUpgrade rpm-develUpgrade rpm-build-libsUpgrade rpmUpgrade rpm-signUpgrade rpm-debuginfo | Jul 19, 2021 | Mar 26, 2021 |
| Amazon_linux | — | Upgrade rpm | Jul 13, 2021 | Mar 26, 2021 |
| Centos_linux | — | Upgrade python3-rpm-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpm-apidocsUpgrade rpm-develUpgrade rpm-plugin-imaUpgrade rpm-pythonUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-debuginfoUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-buildUpgrade rpm-libs-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpmUpgrade rpm-cronUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-sign-debuginfoUpgrade rpm-debugsourceUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-build-libsUpgrade rpm-build-debuginfoUpgrade python3-rpmUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-libsUpgrade rpm-sign | Jun 30, 2021 | Mar 26, 2021 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | Mar 26, 2021 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Jul 21, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rpm-buildUpgrade rpm-signUpgrade rpm-build-libsUpgrade rpm-libsUpgrade rpmUpgrade rpm-develUpgrade rpm-python | Sep 16, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rpm-buildUpgrade rpmUpgrade rpm-libsUpgrade rpm-pythonUpgrade rpm-build-libsUpgrade rpm-develUpgrade rpm-sign | Oct 26, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rpm-buildUpgrade rpm-libsUpgrade rpm-build-libsUpgrade rpm-develUpgrade rpmUpgrade rpm-pythonUpgrade rpm-sign | Sep 7, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-rpmUpgrade rpm-buildUpgrade rpm-build-libsUpgrade rpm-plugin-selinuxUpgrade rpmUpgrade rpm-plugin-syslogUpgrade rpm-plugin-imaUpgrade rpm-apidocsUpgrade rpm-sign-libsUpgrade rpm-plugin-prioresetUpgrade rpm-develUpgrade rpm-cronUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-signUpgrade rpm-libsUpgrade python3-rpm | Jun 28, 2021 | Mar 26, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rpmUpgrade python3-rpmUpgrade rpm-libs | Aug 10, 2021 | Mar 26, 2021 |
| Ibm Aix | — | Apply the fix or workaround for rpm_advisory | Oct 12, 2022 | Mar 26, 2021 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle_linux | — | Upgrade rpm-libsUpgrade rpm-cronUpgrade rpm-develUpgrade python3-rpmUpgrade rpmUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-pythonUpgrade rpm-build-libsUpgrade rpm-signUpgrade rpm-plugin-syslogUpgrade rpm-plugin-imaUpgrade rpm-plugin-prioresetUpgrade rpm-apidocsUpgrade rpm-plugin-selinuxUpgrade rpm-build | Jun 30, 2021 | Mar 11, 2021 |
| Redhat_linux | — | Upgrade rpm-debugsourceUpgrade rpm-develUpgrade rpm-build-libsUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-systemd-inhibitNo solution existsUpgrade rpm-pythonUpgrade rpm-plugin-selinuxUpgrade python3-rpm-debuginfoUpgrade rpm-apidocsUpgrade rpm-libs-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-sign-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-debuginfoUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-cronUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-libsUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpmUpgrade rpm-signUpgrade rpm-plugin-imaUpgrade python3-rpmUpgrade rpm-build-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-build | Jun 30, 2021 | Mar 26, 2021 |
| Rocky_linux | — | Upgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-libsUpgrade rpm-plugin-imaUpgrade rpm-libs-debuginfoUpgrade rpm-plugin-selinuxUpgrade rpm-sign-debuginfoUpgrade rpm-build-libsUpgrade rpm-build-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-signUpgrade rpm-debugsourceUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-buildUpgrade python3-rpmUpgrade rpmUpgrade rpm-develUpgrade rpm-plugin-fapolicyd | May 5, 2022 | Mar 26, 2021 |
| Suse | — | Upgrade rpm-ndb-32bitUpgrade python3-hawkeyUpgrade hawkey-manUpgrade rpm-32bitUpgrade libdnf2Upgrade python3-rpmUpgrade rpmUpgrade rpm-ndbUpgrade python2-rpmUpgrade libdnf-develUpgrade python3-librepoUpgrade libdnf-repo-config-zyppUpgrade rpm-develUpgrade librepo0Upgrade rpm-buildUpgrade rpm-pythonUpgrade python3-libdnfUpgrade librepo-devel | Aug 14, 2021 | Mar 26, 2021 |
| Ubuntu | — | Upgrade librpm8 (Ubuntu Pro)Upgrade librpmio3 (Ubuntu Pro)Upgrade librpmio8 (Ubuntu Pro)Upgrade rpm-common (Ubuntu Pro)Upgrade rpm (Ubuntu Pro)Upgrade librpmsign8 (Ubuntu Pro)Upgrade librpmbuild8 (Ubuntu Pro)Upgrade librpmbuild3 (Ubuntu Pro)Upgrade librpm3 (Ubuntu Pro)Upgrade librpmsign3 (Ubuntu Pro) | Mar 22, 2023 | Mar 26, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 26, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub