There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

An update of the rpm package has been released.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1557-2 advisory.

    Security fixes:
    - CVE-2021-3521: Fixed missing subkey binding signature checking (bsc#1191175)

    Other fixes:

    - accept more signature subpackets marked as critical (bsc#1218686)
    - backport limit support for the autopatch macro (bsc#1189495)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1557-1 advisory.

  - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a     binding signature. RPM does not check the binding signature of subkeys prior to importing them. If an     attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate     public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data     integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an     administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and     public keys from trusted sources. (CVE-2021-3521)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0368 advisory.

  - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a     binding signature. RPM does not check the binding signature of subkeys prior to importing them. If an     attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate     public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data     integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an     administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and     public keys from trusted sources. (CVE-2021-3521)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the rpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a     'binding signature.' RPM does not check the binding signature of subkeys prior to importing them. If an     attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate     public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data     integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an     administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and     public keys from trusted sources. (CVE-2021-3521)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a     'binding signature.' RPM does not check the binding signature of subkeys prior to importing them. If an     attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate     public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data     integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an     administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and     public keys from trusted sources. (CVE-2021-3521)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0c52abde-717b-11ed-98ca-40b034429ecf advisory.

  - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a     binding signature. RPM does not check the binding signature of subkeys prior to importing them. If an     attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate     public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data     integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an     administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and     public keys from trusted sources. (CVE-2021-3521)

  - A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials     after installing a file. A local unprivileged user could use this flaw to exchange the original file with     a symbolic link to a security-critical file and escalate their privileges on the system. The highest     threat from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2021-35938)

  - It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only     implemented for the parent directory of the file to be created. A local unprivileged user who owns another     ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-35939)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202210-22 (RPM: Multiple Vulnerabilities)

  - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a     binding signature. RPM does not check the binding signature of subkeys prior to importing them. If an     attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate     public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data     integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an     administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and     public keys from trusted sources. (CVE-2021-3521)

  - A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass     the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root     privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2021-35937)

  - A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials     after installing a file. A local unprivileged user could use this flaw to exchange the original file with     a symbolic link to a security-critical file and escalate their privileges on the system. The highest     threat from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2021-35938)

  - It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only     implemented for the parent directory of the file to be created. A local unprivileged user who owns another     ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-35939)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the rpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a     binding signature. RPM does not check the binding signature of subkeys prior to importing them. If an     attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate     public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data     integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an     administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and     public keys from trusted sources. (CVE-2021-3521)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:0368 advisory.

  - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a     binding signature. RPM does not check the binding signature of subkeys prior to importing them. If an     attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate     public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data     integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an     administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and     public keys from trusted sources. (CVE-2021-3521)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a     binding signature. RPM does not check the binding signature of subkeys prior to importing them. If an     attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate     public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data     integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an     administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and     public keys from trusted sources. (CVE-2021-3521)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0634 advisory.

    The RPM Package Manager (RPM) is a command-line driven package management system capable of installing,     uninstalling, verifying, querying, and updating software packages.

    Security Fix(es):

    * rpm: RPM does not require subkeys to have a valid binding signature (CVE-2021-3521)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:368 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-0368 advisory.

    [4.14.3-19.2]
    - Address covscan issues in binding sigs validation patch (#2022537)

    [4.14.3-19.1]
    - Validate and require subkey binding sigs on PGP pubkeys (#2022537)
    - Fixes CVE-2021-3521

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0368 advisory.

    The RPM Package Manager (RPM) is a command-line driven package management system capable of installing,     uninstalling, verifying, querying, and updating software packages.

    Security Fix(es):

    * rpm: RPM does not require subkeys to have a valid binding signature (CVE-2021-3521)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0254 advisory.

    The RPM Package Manager (RPM) is a command-line driven package management system capable of installing,     uninstalling, verifying, querying, and updating software packages.

    Security Fix(es):

    * rpm: RPM does not require subkeys to have a valid binding signature (CVE-2021-3521)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203828	Photon OS 3.0: Rpm PHSA-2022-3.0-0445	Nessus	PhotonOS Local Security Checks	medium
203412	Photon OS 4.0: Rpm PHSA-2022-4.0-0243	Nessus	PhotonOS Local Security Checks	medium
198236	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rpm (SUSE-SU-2024:1557-2)	Nessus	SuSE Local Security Checks	medium
195681	RHEL 7 : rpm (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195653	RHEL 6 : rpm (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195188	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rpm (SUSE-SU-2024:1557-1)	Nessus	SuSE Local Security Checks	medium
185044	Rocky Linux 8 : rpm (RLSA-2022:0368)	Nessus	Rocky Linux Local Security Checks	medium
177149	EulerOS Virtualization 3.0.6.0 : rpm (EulerOS-SA-2023-2230)	Nessus	Huawei Local Security Checks	medium
171195	EulerOS 2.0 SP8 : rpm (EulerOS-SA-2023-1335)	Nessus	Huawei Local Security Checks	medium
168328	FreeBSD : rpm4 -- Multiple Vulnerabilities (0c52abde-717b-11ed-98ca-40b034429ecf)	Nessus	FreeBSD Local Security Checks	medium
166726	GLSA-202210-22 : RPM: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
159874	EulerOS Virtualization 2.10.1 : rpm (EulerOS-SA-2022-1386)	Nessus	Huawei Local Security Checks	medium
159842	EulerOS Virtualization 2.10.0 : rpm (EulerOS-SA-2022-1412)	Nessus	Huawei Local Security Checks	medium
158835	AlmaLinux 8 : rpm (ALSA-2022:0368)	Nessus	Alma Linux Local Security Checks	medium
158431	EulerOS 2.0 SP10 : rpm (EulerOS-SA-2022-1234)	Nessus	Huawei Local Security Checks	medium
158394	EulerOS 2.0 SP10 : rpm (EulerOS-SA-2022-1215)	Nessus	Huawei Local Security Checks	medium
158325	RHEL 8 : rpm (RHSA-2022:0634)	Nessus	Red Hat Local Security Checks	medium
157790	Rocky Linux 8 : rpm (RLSA-2022:368)	Nessus	Rocky Linux Local Security Checks	medium
157317	Oracle Linux 8 : rpm (ELSA-2022-0368)	Nessus	Oracle Linux Local Security Checks	medium
157312	RHEL 8 : rpm (RHSA-2022:0368)	Nessus	Red Hat Local Security Checks	medium
157172	EulerOS 2.0 SP9 : rpm (EulerOS-SA-2022-1035)	Nessus	Huawei Local Security Checks	medium
157170	EulerOS 2.0 SP9 : rpm (EulerOS-SA-2022-1015)	Nessus	Huawei Local Security Checks	medium
157100	RHEL 8 : rpm (RHSA-2022:0254)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2021-3521

medium

Tenable Plugins

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium