CVE-2021-3521

    Dashboard / Vulnerabilities / CVE-2021-3521

    CVE-2021-3521

    Published: 22 Aug 2022Last Modified: 8 Jul 2026

    Summary:

    Details: There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

    References: https://access.redhat.com/security/cve/CVE-2021-3521, https://security.gentoo.org/glsa/202210-22, https://bugzilla.redhat.com/show_bug.cgi?id=1941098, https://github.com/rpm-software-management/rpm/commit/bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8, https://github.com/rpm-software-management/rpm/pull/1795/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -5bef402da334595ed9302b8bca1acdf5e88bfe11

    Affected versions

    rpm-4.17.0-release
    rpm-4.17.0-rc1
    rpm-4.17.0-beta1
    rpm-4.17.0-alpha

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-3521 | CVE-DB