CVE-2021-20271

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

• CWE-345
• CWE-345

• https://bugzilla.redhat.com/show_bug.cgi?id=1934125Issue Tracking, Patch, Third Party Advisory
• https://github.com/rpm-software-management/rpm/commit/d6a86b5e69e46cc283b1e06c92343319beb42e21Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMGXO3W6DHPO62GJ4VVF5DEUX5DRUR5K/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHRPNBCRPDJHHQE3MBPSZK4H7X2IM7AC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILPBTPSBRYL4POBI3F4YUSVPSOQNJBY/
• https://security.gentoo.org/glsa/202107-43Third Party Advisory
• https://www.starwindsoftware.com/security/sw-20220805-0002/Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1934125Issue Tracking, Patch, Third Party Advisory
• https://github.com/rpm-software-management/rpm/commit/d6a86b5e69e46cc283b1e06c92343319beb42e21Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMGXO3W6DHPO62GJ4VVF5DEUX5DRUR5K/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHRPNBCRPDJHHQE3MBPSZK4H7X2IM7AC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILPBTPSBRYL4POBI3F4YUSVPSOQNJBY/
• https://security.gentoo.org/glsa/202107-43Third Party Advisory
• https://www.starwindsoftware.com/security/sw-20220805-0002/Third Party Advisory

Published

Mar 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-20266A flaw was found in RPM's hdrblobInit() in lib/header.c. Thi…4.9
• CVE-2021-20267A flaw was found in openstack-neutron's default Open vSwitch…7.1
• CVE-2021-20268An out-of-bounds access flaw was found in the Linux kernel's…7.8
• CVE-2021-20269A flaw was found in the permissions of a log file created by…5.5
• CVE-2021-2027Vulnerability in the Oracle Marketing product of Oracle E-Bu…8.2
• CVE-2021-20270An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7…7.5
• CVE-2021-20272A flaw was found in privoxy before 3.0.32. An assertion fail…7.5
• CVE-2021-20273A flaw was found in privoxy before 3.0.32. A crash can occur…7.5
• CVE-2021-20274A flaw was found in privoxy before 3.0.32. A crash may occur…7.5
• CVE-2021-20275A flaw was found in privoxy before 3.0.32. A invalid read of…7.5
• CVE-2021-20276A flaw was found in privoxy before 3.0.32. Invalid memory ac…7.5
• CVE-2021-20277A flaw was found in Samba's libldb. Multiple, consecutive le…7.5