CVE-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

• CWE-347
• CWE-347

• https://access.redhat.com/security/cve/CVE-2021-3521Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1941098Issue Tracking, Patch, Third Party Advisory
• https://github.com/rpm-software-management/rpm/commit/bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8Patch, Third Party Advisory
• https://github.com/rpm-software-management/rpm/pull/1795/Patch, Third Party Advisory
• https://security.gentoo.org/glsa/202210-22Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2021-3521Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1941098Issue Tracking, Patch, Third Party Advisory
• https://github.com/rpm-software-management/rpm/commit/bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8Patch, Third Party Advisory
• https://github.com/rpm-software-management/rpm/pull/1795/Patch, Third Party Advisory
• https://security.gentoo.org/glsa/202210-22Third Party Advisory

Published

Aug 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35204NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflecte…5.4
• CVE-2021-35205NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows …5.4
• CVE-2021-35206Gitpod before 0.6.0 allows unvalidated redirects.6.1
• CVE-2021-35207An issue was discovered in Zimbra Collaboration Suite 8.8 be…6.1
• CVE-2021-35208An issue was discovered in ZmMailMsgView.js in the Calendar …5.4
• CVE-2021-35209An issue was discovered in ProxyServlet.java in the /proxy s…9.8
• CVE-2021-35210Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through…6.1
• CVE-2021-35211Microsoft discovered a remote code execution (RCE) vulnerabi…10
• CVE-2021-35212An SQL injection Privilege Escalation Vulnerability was disc…8.8
• CVE-2021-35213An Improper Access Control Privilege Escalation Vulnerabilit…8.8
• CVE-2021-35214The vulnerability in SolarWinds Pingdom can be described as …4.7
• CVE-2021-35215Insecure deserialization leading to Remote Code Execution wa…8.8