Lucene search

K
cve[email protected]CVE-2021-3521
HistoryAug 22, 2022 - 3:15 p.m.

CVE-2021-3521

2022-08-2215:15:13
CWE-347
web.nvd.nist.gov
185
6
cve-2021-3521
rpm
signature functionality
openpgp subkeys
binding signature
data integrity
rpm repository
untrusted rpm
public key

4.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.7%

There is a flaw in RPM’s signature functionality. OpenPGP subkeys are associated with a primary key via a “binding signature.” RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

Affected configurations

Vulners
NVD
Node
rpmrpmRange4.18.0
OR
rpmrpmRange4.18.0
OR
rpmrpmRange4.18.0
VendorProductVersionCPE
rpmrpm*cpe:2.3:a:rpm:rpm:*:*:*:*:*:*:*:*
rpmrpm*cpe:2.3:a:rpm:rpm:*:*:*:*:*:*:*:*
rpmrpm*cpe:2.3:a:rpm:rpm:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "RPM",
    "versions": [
      {
        "version": "Fixed in rpm-4.18.0-beta1, rpm-4.18.0-alpha2, rpm-4.18.0-alpha1 .",
        "status": "affected"
      }
    ]
  }
]

Social References

More

4.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.7%