A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package whose signature header was modified to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity confidentiality and system availability.

🗓️ 01 Apr 2021 07:00:00Reported by MicrosoftType

Flaw in RPM signature check during package reading enables a modified package to corrupt the database and execute code.

Reporter	Title	Published	Views	Family All 161
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by vulnerability in rpm. (CVE-2021-20271)	7 Jul 202210:50	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Packet Capture is using components with known vulnerabilities	31 Mar 202214:40	–	ibm
IBM Security Bulletins	Security Bulletin: Due to RPM, AIX is vulnerable to arbitrary code execution (CVE-2021-20271), RPM database corruption (CVE-2021-3421), and denial of service (CVE-2021-20266)	23 Sep 202216:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	3 Dec 202118:52	–	ibm
Tenable Nessus	Amazon Linux 2 : rpm (ALAS-2021-1689)	16 Jul 202100:00	–	nessus
Tenable Nessus	Amazon Linux AMI : rpm (ALAS-2021-1521)	13 Jul 202100:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0046: rpm (ALINUX3-SA-2021:0046)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : rpm (ALSA-2021:2574)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : rpm (CESA-2021:2574)	30 Jun 202100:00	–	nessus