CVE-2021-20271

Name	CVE-2021-20271
Description	A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	985308

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rpm (PTS)	jessie	4.11.3-1.1	vulnerable
	stretch	4.12.0.2+dfsg1-2	vulnerable
	buster	4.14.2.1+dfsg1-1	vulnerable
	bullseye	4.16.1.2+dfsg1-3	fixed
	bookworm	4.18.0+dfsg-1+deb12u1	fixed
	sid, trixie	4.20.0+dfsg-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rpm	source	(unstable)	4.16.1.2+dfsg1-1			985308

Notes

[buster] - rpm <no-dsa> (Minor issue)
[stretch] - rpm <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=1934125
[jessie] - rpm <no-dsa> (Minor issue)