CVE-2021-20271: Fedoraproject Fedora

High severity, CVSS 7.0. EPSS: 0.8% chance of exploitation in the next 30 days.

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

Affected products

• Fedoraproject Fedora: version 32 only; version 33 only; version 34 only
• Red Hat Enterprise Linux: version 8.0 only
• Rpm Rpm: from 4.15.0, before 4.15.1.3 (fixed in 4.15.1.3); from 4.16.0, before 4.16.1.3 (fixed in 4.16.1.3); version 4.15.0 only; version 4.16.0 only
• Starwindsoftware Starwind Virtual San: version v8 only

Published 2021-03-26. Last modified 2026-06-17.