PatchTheCVECVE-2021-3521: There is a flaw in RPM's signature functionality
CVE-2021-3521 is a medium-severity flaw (CVSS 4.7) affecting rpm. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.7 (Medium) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.3% (top 74%) |
| CISA exploited list | No |
| Weakness | CWE-347 |
| Published | 2022-08-22 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-3521?
rpm: upgrade to 4.17.1. Exact commands for each OS are on this page.
Is CVE-2021-3521 being exploited?
CVE-2021-3521 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-3521 affect?
CVE-2021-3521 affects rpm. Severity is medium (CVSS 4.7). There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or soc
How urgent is CVE-2021-3521?
Priority 23/100. No elevated risk signals yet.
Related CVEs
- CVE-2021-3421 MEDIUM 5.5 UPGRADE MITIGATE A flaw was found in the RPM package in the read functionality
- CVE-2021-35939 MEDIUM 6.7 UPGRADE MITIGATE It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented f
- CVE-2021-35938 MEDIUM 6.7 UPGRADE MITIGATE A symbolic link issue was found in rpm
- CVE-2021-35937 MEDIUM 6.4 UPGRADE MITIGATE A race condition vulnerability was found in rpm
- CVE-2021-20271 HIGH 7.0 UPGRADE MITIGATE A flaw was found in RPM's signature check functionality when reading a package file