How severe is CVE-2021-3521?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 4.7 out of 10.

What type of vulnerability is CVE-2021-3521?

This is classified as CWE-347, which is a common weakness in software security.

CVE-2021-3521 - MEDIUM Severity | CVSS 4.7

Vulnerability Description

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

Related Vulnerabilities

CVE-2023-36811

MEDIUM

CVSS:4.7(Medium)

borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives ...

CWE-3472023

CVE-2017-18407

MEDIUM

CVSS:4.8(Medium)

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).

CWE-3472017

CVE-2024-48948

MEDIUM

CVSS:4.8(Medium)

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the ellipti...

CWE-3472024

CVE-2024-23960

MEDIUM

CVSS:4.6(Medium)

Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability. This vulnerability allows physically present attackers to bypass signature validation mechanism on affected installations o...

CWE-3472024

CVE-2020-3308

MEDIUM

CVSS:4.9(Medium)

A vulnerability in the Image Signature Verification feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with administrator-level credentials to insta...

CWE-3472020

CVE-2021-1461

MEDIUM

CVSS:4.9(Medium)

A vulnerability in the Image Signature Verification feature of Cisco SD-WAN Software could allow an authenticated, remote attacker with Administrator-level credentials to install a malicious soft...

CWE-3472021