CVE-2021-3421

mediumpriority · track · 22EPSS 0.006 · 51 %ileDEEUFRRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.65% (51st) EPSS

CVSS 4.3 · medium

Is it mine?

20 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.

cvss

Technical severity, 0–10. One row per scoring source.

5.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:Nprimary · NVD / NIST USexploitability 1.8 · impact 3.6

v3.15.3mediumAV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.15.1mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-347USCWE-347US

affected products (20)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Dell NetWorker vProxy < 4.3.0-40all versionscert_bundDEcpe:/a:dell:networker:vproxy__4.3.0-40
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
Open Source CentOSall versionscert_bundDEcpe:/o:centos:centos:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux 8.0all versionscert_bundDEcpe:/o:redhat:enterprise_linux:8.0
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
n/a rpm≤ rpm 4.17.0-alphaenisa_euvdEU
Red Hat Inc. RPM≤ 4.16.1.3fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.5fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 4.7fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.7fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 10fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU
fedoraproject fedora= 32nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 33nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 34nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
redhat enterprise linux= 8.0nvdUScpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*
rpm rpm< 4.16.1.3nvdUScpe:2.3:a:rpm:rpm:*:*:*:*:*:*:*:*

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-2020RPM: Mehrere SchwachstellenDeutsch2021-03-31csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in RPM und Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen und um Daten zu manipulieren.
WID-SEC-W-2023-1855RPM: Schwachstelle ermöglicht Manipulation von DateienDeutsch2021-05-19csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in RPM ausnutzen, um Dateien zu manipulieren.
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd certfr NVD CVE.org MITRE

published 2021-05-19modified 2026-06-17

references (26)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan