cbcvebase.
CVE-2021-35937
published 2022-08-25

CVE-2021-35937: A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to…

medium6.4CVSS 3.1
AVLACHPRHUINSUCHIHAH
A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected

14 ranges
VendorProductVersion rangeFixed in
debianrpm< rpm 4.18.0+dfsg-1 (bookworm)rpm 4.18.0+dfsg-1 (bookworm)
fedoraprojectfedora——
msrccbl2_rpm_4.18.0-1_on_cbl_mariner_2.0——
msrccbl_mariner_2.0_arm——
msrccbl_mariner_2.0_x64——
msrccm1_rpm_4.14.2-15_on_cbl_mariner_1.0——
redhatenterprise_linux——
redhatenterprise_linux——
redhatenterprise_linux——
redhatenterprise_linux——
rpmrpm< 4.18.04.18.0
rpmrpm>= 0 < 4.18.0+dfsg-14.18.0+dfsg-1
rpmrpm>= 0 < 4.18.0+dfsg-14.18.0+dfsg-1
rpmrpm>= 0 < 4.18.0+dfsg-14.18.0+dfsg-1

CVSS provenance

nvdv3.16.4MEDIUMCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH