CVE-2021-20266: Medium severity IBM QRadar SIEM vulnerability
A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.
Other sources
Missing length checks in hdrblobInit() which may be able to cause memory unsafety.
— Red Hat
RPM Project RPM is vulnerable to a denial of service, caused by an out-of-bounds read flaw in the hdrblobInit function in lib/header.c. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rpmto a version that resolves this vulnerability.Fixed in 4.17.0 - Upgrade
Upgrade
alpine/rpmto a version that resolves this vulnerability.Fixed in 4.16.1.3-r0
Event History
Frequently Asked Questions
What is CVE-2021-20266?
CVE-2021-20266 is a vulnerability in the RPM Project RPM software that allows a local authenticated attacker to cause a denial of service condition.
How can the CVE-2021-20266 vulnerability be exploited?
The CVE-2021-20266 vulnerability can be exploited by sending a specially-crafted request to the hdrblobInit function in lib/header.c.
What is the severity of CVE-2021-20266?
The severity of CVE-2021-20266 is low with a CVSS score of 3.1.
Which software is affected by CVE-2021-20266?
IBM QRadar SIEM versions 7.5.0 GA, 7.4.3 GA - 7.4.3 FP4, and 7.3.3 GA - 7.3.3 FP10 are affected by CVE-2021-20266.
How can I fix the CVE-2021-20266 vulnerability?
To fix the CVE-2021-20266 vulnerability, apply the necessary patches provided by IBM for your specific version of IBM QRadar SIEM.