VDB
CVE-2021-3445
CVE-2021-3445
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.
EPSS 1.12% · 64.8th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
1.12%
64.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:22.04:LTS | libdnf | 0 |
Timeline
- May 19, 2021 CVE Published
- May 20, 2021 EPSS Score
- Jul 23, 2021 EPSS Score
- Sep 23, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Jan 25, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 28, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 29, 2022 EPSS Score
- Oct 1, 2022 EPSS Score
- Dec 2, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2021-3445 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2021-3445 third-party-advisory
- https://github.com/rpm-software-management/libdnf/commit/930f2582f91077b3f338b84cf9567559d52713de third-party-advisory