CVE-2021-3521 Security feature bypass in RPM

What is CVE-2021-3521?

CVE-2021-3521 is a medium-severity vulnerability in RPM, published on 22 Aug 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

Weakness: CWE-347

Which versions are affected by CVE-2021-3521?

It affects 1 product.

Products include Rpm Rpm.

How do I fix CVE-2021-3521?

Apply the vendor's patch.

Is CVE-2021-3521 being exploited?

There is no known exploitation of CVE-2021-3521 in the wild and no public exploit code.

Other vulnerabilities in RPM

• CVE-2014-8118 Integer overflow in n/a Critical 10.0
• CVE-2011-3378 Memory corruption in n/a Critical 9.3
• CVE-2017-7501 Path traversal in rpm High 7.8
• CVE-2017-7500 Path traversal in rpm High 7.3
• CVE-2005-4889 Race condition in n/a High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALSA-2022:0368, AZL-10637, CLSA-2022-1644869406, CLSA-2026-1777539108, CLSA-2026-1777539405, CLSA-2026-1777545003 and 13 more.