CVE-2021-20271: 
NixOS vulnerability analysis and mitigation

A flaw was discovered in RPM's signature check functionality when reading a package file (CVE-2021-20271). The vulnerability was disclosed in March 2021 and affects the RPM Package Manager, which is a command-line driven package management system used in various Linux distributions. The vulnerability allows an attacker to bypass signature checks through a corrupted RPM package (Red Hat CVE, Ubuntu CVE).

The vulnerability exists in the headerMergeLegacySigs function where the signature header verification process can be bypassed. The flaw allows copying of unknown tags from the signature header into the RPM metadata header without proper type and size validation. This can lead to corrupt header tags being placed into the RPM database if the package is installed (Bugzilla Report). The vulnerability has been assigned a CVSS v3.1 base score of 7.0 (High) with the vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (StarWind Security).

The vulnerability can result in RPM database corruption and potential code execution if exploited. The highest threats from this vulnerability are to data integrity, confidentiality, and system availability. When exploited, it can cause the header to be inaccessible within the rpm database and lead to data integrity issues such as corrupt headers, bad tag errors, installed packages appearing as not installed, and seemingly missing dependencies (Bugzilla Report).

To exploit this vulnerability, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM package. The attack requires the ability to convince a victim to install a seemingly verifiable package whose signature header has been modified (Red Hat CVE).

The vulnerability has been fixed in RPM version 4.16.1.3 and later releases. For affected systems, it is strongly recommended to only use RPMs from trusted repositories. If the database becomes corrupted, it can be repaired using the rpmdb --rebuilddb command, followed by installing the non-corrupted package (Gentoo Security, Bugzilla Report).