Most recent entries from all

ALSA-2022:0368 — Moderate: rpm security update

Affected: AlmaLinux:8: rpm-build, AlmaLinux:8: rpm-plugin-fapolicyd

The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

Security Fix(es):

* rpm: RPM does not require subkeys to have a valid binding signature (CVE-2021-3521)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-04926

Withdrawn: BELL-CVE-2021-3521 — CVE-2021-3521 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2022-avi-544 — De multiples vulnérabilités ont été découvertes dans IBM Netcool Operations Insight. Certaines d'entre elles permettent…

certfr-2022-avi-544

EUVD-2026-20999

fkie_cve-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

GHSA-pr6x-p264-jrpq

gsd-2021-3521

msrc_CVE-2021-3521 — There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding sign…

msrc_CVE-2021-3521

OESA-2021-1431 — rpm security update

Affected: openEuler:20.03-LTS-SP1: rpm, openEuler:20.03-LTS-SP2: rpm

The RPM Package Manager (RPM) is a powerful package management system capability as below Security Fix(es): The OpenPGP subkey is associated with the master key through a binding signature. RPM will not check their binding signature before importing the subkey; if the attacker can add it or the other party of social engineering adds the malicious subkey to the legal public Key, RPM may mistakenly trust malicious signatures.(CVE-2021-3521)

openSUSE-SU-2024:12245-1 — librpmbuild9-4.17.1-1.1 on GA media

librpmbuild9-4.17.1-1.1 on GA media

RHSA-2022:0254 — Red Hat Security Advisory: rpm security update

rpm: RPM does not require subkeys to have a valid binding signature

SUSE-SU-2024:1557-2 — Security update for rpm

Security update for rpm

UBUNTU-CVE-2021-3521

Affected: Ubuntu:Pro:14.04:LTS: rpm, Ubuntu:Pro:16.04:LTS: rpm, Ubuntu:Pro:18.04:LTS: rpm, Ubuntu:Pro:20.04:LTS: rpm, Ubuntu:22.04:LTS: rpm, Ubuntu:24.04:LTS: rpm, Ubuntu:25.10: rpm, Ubuntu:26.04:LTS: rpm

WID-SEC-W-2022-1243 — RPM: Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen in RPM ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Dateien zu manipulieren oder sonstige Auswirkungen zu verursachen.