SUSE-SU-2021:2682-1

    Dashboard / Vulnerabilities / SUSE-SU-2021:2682-1

    SUSE-SU-2021:2682-1

    Published: 12 Aug 2021Last Modified: 4 Feb 2026

    Summary: Security update for rpm

    Details: This update for rpm fixes the following issues: - Changed default package verification level to 'none' to be compatible to rpm-4.14.1 - Made illegal obsoletes a warning - Fixed a potential access of freed mem in ndb's glue code (bsc#1179416) - Added support for enforcing signature policy and payload verification step to transactions (jsc#SLE-17817) - Added :humansi and :hmaniec query formatters for human readable output - Added query selectors for whatobsoletes and whatconflicts - Added support for sorting caret higher than base version - rpm does no longer require the signature header to be in a contiguous region when signing (bsc#1181805) Security fixes: - CVE-2021-3421: A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity (bsc#1183543) - CVE-2021-20271: A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability (bsc#1183545) - CVE-2021-20266: A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.

    References: https://www.suse.com/support/update/announcement/2021/suse-su-20212682-1/, https://bugzilla.suse.com/1179416, https://bugzilla.suse.com/1181805, https://bugzilla.suse.com/1183543, https://bugzilla.suse.com/1183545, https://www.suse.com/security/cve/CVE-2021-20266, https://www.suse.com/security/cve/CVE-2021-20271, https://www.suse.com/security/cve/CVE-2021-3421

    Affected packages

    Package

    Name: python-rpm

    Purl: pkg:rpm/suse/python-rpm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.14.3-37.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2021:2682-1 | CVE-DB