Recent Vulnerabilities Research Posts Trends Blog About Contact

Related Vulnerabilities: CVE-2021-20271 CVE-2021-3421

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability. (CVE-2021-20271) A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. (CVE-2021-3421)

Source

ALAS2-2021-1689

Amazon Linux 2 Security Advisory: ALAS-2021-1689
Advisory Release Date: 2021-07-14 20:43 Pacific
Advisory Updated Date: 2021-07-15 21:39 Pacific

Severity: Medium

References: CVE-2021-20271 CVE-2021-3421

Issue Overview:

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability. (CVE-2021-20271)

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. (CVE-2021-3421)

Affected Packages:

rpm

Issue Correction:
Run yum update rpm to update your system.

New Packages:

aarch64:
    rpm-4.11.3-40.amzn2.0.6.aarch64
    rpm-libs-4.11.3-40.amzn2.0.6.aarch64
    rpm-build-libs-4.11.3-40.amzn2.0.6.aarch64
    rpm-devel-4.11.3-40.amzn2.0.6.aarch64
    rpm-build-4.11.3-40.amzn2.0.6.aarch64
    rpm-sign-4.11.3-40.amzn2.0.6.aarch64
    python2-rpm-4.11.3-40.amzn2.0.6.aarch64
    python3-rpm-4.11.3-40.amzn2.0.6.aarch64
    rpm-plugin-systemd-inhibit-4.11.3-40.amzn2.0.6.aarch64
    rpm-debuginfo-4.11.3-40.amzn2.0.6.aarch64

i686:
    rpm-4.11.3-40.amzn2.0.6.i686
    rpm-libs-4.11.3-40.amzn2.0.6.i686
    rpm-build-libs-4.11.3-40.amzn2.0.6.i686
    rpm-devel-4.11.3-40.amzn2.0.6.i686
    rpm-build-4.11.3-40.amzn2.0.6.i686
    rpm-sign-4.11.3-40.amzn2.0.6.i686
    python2-rpm-4.11.3-40.amzn2.0.6.i686
    python3-rpm-4.11.3-40.amzn2.0.6.i686
    rpm-plugin-systemd-inhibit-4.11.3-40.amzn2.0.6.i686
    rpm-debuginfo-4.11.3-40.amzn2.0.6.i686

noarch:
    rpm-apidocs-4.11.3-40.amzn2.0.6.noarch
    rpm-cron-4.11.3-40.amzn2.0.6.noarch

src:
    rpm-4.11.3-40.amzn2.0.6.src

x86_64:
    rpm-4.11.3-40.amzn2.0.6.x86_64
    rpm-libs-4.11.3-40.amzn2.0.6.x86_64
    rpm-build-libs-4.11.3-40.amzn2.0.6.x86_64
    rpm-devel-4.11.3-40.amzn2.0.6.x86_64
    rpm-build-4.11.3-40.amzn2.0.6.x86_64
    rpm-sign-4.11.3-40.amzn2.0.6.x86_64
    python2-rpm-4.11.3-40.amzn2.0.6.x86_64
    python3-rpm-4.11.3-40.amzn2.0.6.x86_64
    rpm-plugin-systemd-inhibit-4.11.3-40.amzn2.0.6.x86_64
    rpm-debuginfo-4.11.3-40.amzn2.0.6.x86_64

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

ALAS2-2021-1689

ALAS2-2021-1689

Vulmon Search

About

Products

Connect