CVE-2021-20271 Code injection in rpm

High 7.0 Published 26 Mar 2021 Updated 3 Aug 2024

Attackers can execute arbitrary code and corrupt the database by tricking users into installing a modified RPM package with a tampered signature header.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-20271?

CVE-2021-20271 is a high-severity code injection vulnerability in Fedoraproject Fedora, published on 26 Mar 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

Weakness: CWE-345

Which versions are affected by CVE-2021-20271?

It affects 4 products.

Linux distribution packages (40)

`rpm` Red Hat:enterprise_linux:7::client	All versions	`0:4.11.3-48.el7_9`
`rpm-apidocs` Red Hat:enterprise_linux:7::client	All versions	`0:4.11.3-48.el7_9`
`rpm-build` Red Hat:enterprise_linux:7::client	All versions	`0:4.11.3-48.el7_9`
`rpm-build-libs` Red Hat:enterprise_linux:7::client	All versions	`0:4.11.3-48.el7_9`
`rpm-cron` Red Hat:enterprise_linux:7::client	All versions	`0:4.11.3-48.el7_9`
`rpm-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:4.11.3-48.el7_9`
`rpm-devel` Red Hat:enterprise_linux:7::client	All versions	`0:4.11.3-48.el7_9`
`rpm-libs` Red Hat:enterprise_linux:7::client	All versions	`0:4.11.3-48.el7_9`
`rpm-plugin-systemd-inhibit` Red Hat:enterprise_linux:7::client	All versions	`0:4.11.3-48.el7_9`
`rpm-python` Red Hat:enterprise_linux:7::client	All versions	`0:4.11.3-48.el7_9`
`rpm-sign` Red Hat:enterprise_linux:7::client	All versions	`0:4.11.3-48.el7_9`
`rpm-apidocs` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.11.3-48.el7_9`
`rpm-cron` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.11.3-48.el7_9`
`rpm-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.11.3-48.el7_9`
`rpm-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.11.3-48.el7_9`
`rpm-plugin-systemd-inhibit` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.11.3-48.el7_9`
`rpm-sign` Red Hat:enterprise_linux:7::computenode	All versions	`0:4.11.3-48.el7_9`
`rpm` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.3-48.el7_9`
`rpm-apidocs` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.3-48.el7_9`
`rpm-build` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.3-48.el7_9`
`rpm-build-libs` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.3-48.el7_9`
`rpm-cron` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.3-48.el7_9`
`rpm-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.3-48.el7_9`
`rpm-devel` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.3-48.el7_9`
`rpm-libs` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.3-48.el7_9`
`rpm-plugin-systemd-inhibit` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.3-48.el7_9`
`rpm-python` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.3-48.el7_9`
`rpm-sign` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.3-48.el7_9`
`rpm` Red Hat:enterprise_linux:7::workstation	All versions	`0:4.11.3-48.el7_9`
`rpm-apidocs` Red Hat:enterprise_linux:7::workstation	All versions	`0:4.11.3-48.el7_9`
`rpm-build` Red Hat:enterprise_linux:7::workstation	All versions	`0:4.11.3-48.el7_9`
`rpm-build-libs` Red Hat:enterprise_linux:7::workstation	All versions	`0:4.11.3-48.el7_9`
`rpm-cron` Red Hat:enterprise_linux:7::workstation	All versions	`0:4.11.3-48.el7_9`
`rpm-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:4.11.3-48.el7_9`
`rpm-devel` Red Hat:enterprise_linux:7::workstation	All versions	`0:4.11.3-48.el7_9`
`rpm-libs` Red Hat:enterprise_linux:7::workstation	All versions	`0:4.11.3-48.el7_9`
`rpm-plugin-systemd-inhibit` Red Hat:enterprise_linux:7::workstation	All versions	`0:4.11.3-48.el7_9`
`rpm-python` Red Hat:enterprise_linux:7::workstation	All versions	`0:4.11.3-48.el7_9`
`rpm-sign` Red Hat:enterprise_linux:7::workstation	All versions	`0:4.11.3-48.el7_9`
`rpm` Red Hat:rhel_aus:7.6::server	All versions	`0:4.11.3-35.el7_6.2`

Products include Fedoraproject Fedora, Redhat Enterprise Linux, Rpm Rpm, Starwindsoftware Starwind Virtual San.

How do I fix CVE-2021-20271?

Apply the vendor's patch.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-20271 being exploited?

There is no known exploitation of CVE-2021-20271 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-20271, GHSA-77pm-gxx7-5c5f, OESA-2021-1163, RHSA-2021:4771, RHSA-2021:4785, RHSA-2021:4975 and 1 more.