CVE-2021-3445

2021-05-1913:44:23

CWE-347

redhat

www.cve.org

libdnf

signature verification

code execution

rpm package

confidentiality

integrity

system availability

AI Score

7.8

Confidence

High

EPSS

0.002

Percentile

61.7%

JSON

A flaw was found in libdnf’s signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.

CNA Affected

[
  {
    "product": "libdnf",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "libdnf 0.60.1"
      }
    ]
  }
]