Vulnerability · Published May 19, 2021 · Assigned by redhat
CVE-2021-3421
Medium 5.5
In plain English
A medium-severity security flaw in rpm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.6%top 48.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | rpm | 4.16.1.3-r0 | ALPINE-CVE-2021-3421 |
| Alpine:v3.21 | rpm | 4.16.1.3-r0 | ALPINE-CVE-2021-3421 |
| Alpine:v3.22 | rpm | 4.16.1.3-r0 | ALPINE-CVE-2021-3421 |
| Alpine:v3.23 | rpm | 4.16.1.3-r0 | ALPINE-CVE-2021-3421 |
| Alpine:v3.24 | rpm | 4.16.1.3-r0 | ALPINE-CVE-2021-3421 |
| Debian:12 | rpm | 4.16.1.2+dfsg1-1 | DEBIAN-CVE-2021-3421 |
| Debian:13 | rpm | 4.16.1.2+dfsg1-1 | DEBIAN-CVE-2021-3421 |
| Debian:14 | rpm | 4.16.1.2+dfsg1-1 | DEBIAN-CVE-2021-3421 |
| Rocky Linux:8 | rpm | 0:4.14.3-14.el8_4 | RLSA-2021:2574 |
Affected products (as reported)
Weakness: CWE-347
References
- FEDORA-2021-2383d950fd vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-8d52a8a999 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-662680e477 vendor-advisory, x_refsource_FEDORA
- https://bugzilla.redhat.com/show_bug.cgi?id=1927747 x_refsource_MISC
- GLSA-202107-43 vendor-advisory, x_refsource_GENTOO