Rpm

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Rpm product.

RSS Feeds for Rpm security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Rpm products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Rpm Sorted by Most Security Vulnerabilities since 2018

Rpm13 vulnerabilities

Rpm Libcomps1 vulnerability

Rpm Libdnf1 vulnerability

Rpm Yum Utils1 vulnerability

By the Year

In 2026 there have been 0 vulnerabilities in Rpm. Rpm did not have any published security vulnerabilities last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	0	0.00
2024	0	0.00
2023	0	0.00
2022	4	6.13
2021	4	6.50
2020	0	0.00
2019	1	8.80
2018	1	0.00

It may take a day or so for new Rpm vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Rpm Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2021-35939	Aug 26, 2022	Linux Kernel Local Privilege Escalation via Incomplete Path Permission Check It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Rpm
CVE-2021-35938	Aug 25, 2022	RPM Symbolic Link Abuse Escalation (CVE202135938) A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Rpm
CVE-2021-35937	Aug 25, 2022	rpm race condition allows unprivileged user to gain root (CVE-2021-35937) A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Rpm
CVE-2021-3521	Aug 22, 2022	CVE-2021-3521: RPM Subkey Binding Signature Bypass Data Integrity Breach There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.	Rpm
CVE-2021-3445	May 19, 2021	A flaw was found in libdnf's signature verification functionality in versions before 0.60.1 A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.	Libdnf
CVE-2021-3421	May 19, 2021	A flaw was found in the RPM package in the read functionality A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.	Rpm
CVE-2021-20266	Apr 30, 2021	A flaw was found in RPM's hdrblobInit() in lib/header.c A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.	Rpm
CVE-2021-20271	Mar 26, 2021	A flaw was found in RPM's signature check functionality when reading a package file A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.	Rpm
CVE-2019-3817	Mar 27, 2019	A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.	Libcomps
CVE-2018-10897	Aug 01, 2018	A directory traversal issue was found in reposync A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.	Yum Utils