4.7

CVE-2021-3521: rpm

CVSS: 4.7v3.1MediumModified
AliasesMGASA-2022-0321SUSE-SU-2024:1557-1SUSE-SU-2024:1557-2
Published 22-08-2022Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2021-3521 is a medium (CVSS 4.7) vulnerability in rpm. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24% of scored vulnerabilities.

Overall risk
19/100
0100
Low · default modelHow is this calculated?
CVSS score
4.7/10
010
Medium · v3.1 (NVD)
EPSS score
0.33%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 22-08-2022
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.33%

Chance of exploitation in the next 30 days

Percentile

24%

Versus all other CVEs

30-day change

0.00 pp

From 0.32% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.33%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse31 products
  • python-rpm&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 4.14.3-150400.59.16.1
  • python-rpm&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 4.14.3-150400.59.16.1
  • python-rpm&distro=SUSE Linux Enterprise Micro 5.4< 4.14.3-150400.59.16.1
  • python-rpm&distro=SUSE Linux Enterprise Micro 5.5< 4.14.3-150400.59.16.1
  • python-rpm&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5< 4.14.3-150400.59.16.1
Redhat29 products
  • python3-rpm< 0:4.14.3-14.el8_4.2 | < 0:4.14.3-19.el8_5.2 | < 0:4.14.2-40.el8_2
  • python3-rpm-debuginfo< 0:4.14.3-14.el8_4.2 | < 0:4.14.3-19.el8_5.2 | < 0:4.14.2-40.el8_2
  • rpm< 0:4.14.3-14.el8_4.2 | < 0:4.14.3-19.el8_5.2 | < 0:4.14.2-40.el8_2
  • rpm-apidocs< 0:4.14.3-14.el8_4.2 | < 0:4.14.3-19.el8_5.2 | < 0:4.14.2-40.el8_2
  • rpm-build< 0:4.14.3-14.el8_4.2 | < 0:4.14.3-19.el8_5.2 | < 0:4.14.2-40.el8_2
Opensuse10 products
  • python-rpm&distro=openSUSE Leap 15.5< 4.14.3-150400.59.16.1
  • python-rpm&distro=openSUSE Leap 15.6< 4.14.3-150400.59.16.1
  • python-rpm&distro=openSUSE Leap Micro 5.4< 4.14.3-150400.59.16.1
  • rpm-ndb&distro=openSUSE Leap 15.5< 4.14.3-150400.59.16.1
  • rpm-ndb&distro=openSUSE Leap 15.6< 4.14.3-150400.59.16.1
Debian1 product
  • rpm< 4.18.0+dfsg-1
Mageia1 product
  • rpm< 4.16.1.3-1.2.mga8
Rpm1 product
Ubuntu1 product
  • rpmAll versions (No fix recorded)

7 vendors · 74 products

References

25 links
Show all 25 references