CVE-2021-3445: fedoraproject fedora
Vulnerability summary
CVE-2021-3445 is a high (CVSS 7.5) vulnerability in fedoraproject fedora. EPSS estimates a 1.12% chance of exploitation in the next 30 days, higher than 65.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 19-05-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated6.4MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.12%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
0.00 pp
From 1.12% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat19 products
- enterprise_linux8.0
- dnf< 0:4.7.0-4.el8
- dnf-automatic< 0:4.7.0-4.el8
- dnf-data< 0:4.7.0-4.el8
- dnf-plugins-core< 0:4.0.21-3.el8
Debian1 product
- libdnf< 0.55.2-6
Fedoraproject1 product
- fedoraEOL33 | 34
Rpm1 product
- libdnf< 0.60.1
Ubuntu1 product
- libdnf< 0.55.2-6
5 vendors · 23 products
References
37 links- bugzilla.redhat.com/show_bug.cgi?id=1932079X Refsource MISCREPORTIssue TrackingMitigationThird Party Advisory
