CVE-2021-3421

Related Vulnerabilities: CVE-2021-3421  

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity.

Description

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity.

Statement

To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM. It is strongly recommended to only use RPMs from trusted repositories.

To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM. It is strongly recommended to only use RPMs from trusted repositories.

Additional Information

  • Bugzilla 1927747: CVE-2021-3421 rpm: unsigned signature header leads to string injection into an rpm database
  • CWE-347->CWE-89: Improper Verification of Cryptographic Signature leads to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
  • FAQ: Frequently asked questions about CVE-2021-3421