CVEvulnerability
CVE-2021-3445
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-05-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.1 MEDIUM — AV:N/AC:H/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-347
Description
A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.
Affected configurations
• rpm libdnf (< 0.60.1)
• fedoraproject fedora 33
• fedoraproject fedora 34
• redhat enterprise linux 8.0
Related
Weakness · CWE (1)
- CWE-347 Improper Verification of Cryptographic Signature weakness
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1932079 Issue Tracking, Mitigation, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPMFGGQ5T6WVFTFX3OKMVTTM5O4EXWZR/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4NL7TNWAHJ6JVRABQUPWHKKCTHUZMNF/ lists.fedoraproject.org
- https://bugzilla.redhat.com/show_bug.cgi?id=1932079 Issue Tracking, Mitigation, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPMFGGQ5T6WVFTFX3OKMVTTM5O4EXWZR/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4NL7TNWAHJ6JVRABQUPWHKKCTHUZMNF/ lists.fedoraproject.org