CVE-2021-35938
Severity CVSS v4.0:
Pending analysis
Type:
CWE-59
Link Following
Publication date:
25/08/2022
Last modified:
29/11/2022
Description
A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Impact
Base Score 3.x
6.70
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:rpm:rpm:*:*:*:*:*:*:*:* | 4.18.0 (excluding) | |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | ||
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | ||
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | ||
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://access.redhat.com/security/cve/CVE-2021-35938
- https://bugzilla.redhat.com/show_bug.cgi?id=1964114
- https://bugzilla.suse.com/show_bug.cgi?id=1157880
- https://github.com/rpm-software-management/rpm/commit/25a435e90844ea98fe5eb7bef22c1aecf3a9c033
- https://github.com/rpm-software-management/rpm/pull/1919
- https://rpm.org/wiki/Releases/4.18.0
- https://security.gentoo.org/glsa/202210-22