It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
References
Link | Resource |
---|---|
https://access.redhat.com/security/cve/CVE-2021-35939 | Third Party Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=1964129 | Exploit Issue Tracking Third Party Advisory |
https://github.com/rpm-software-management/rpm/commit/96ec957e281220f8e137a2d5eb23b83a6377d556 | Patch Third Party Advisory |
https://github.com/rpm-software-management/rpm/pull/1919 | Patch Third Party Advisory |
https://rpm.org/wiki/Releases/4.18.0 | Release Notes Vendor Advisory |
https://security.gentoo.org/glsa/202210-22 | Third Party Advisory |
Configurations
History
29 Nov 2022, 17:18
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.7 |
References | (GENTOO) https://security.gentoo.org/glsa/202210-22 - Third Party Advisory |
31 Oct 2022, 04:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
01 Sep 2022, 16:16
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-59 | |
CPE | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:a:rpm:rpm:*:*:*:*:*:*:*:* |
|
First Time |
Redhat
Rpm Rpm rpm Redhat enterprise Linux |
|
References | (MISC) https://access.redhat.com/security/cve/CVE-2021-35939 - Third Party Advisory | |
References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1964129 - Exploit, Issue Tracking, Third Party Advisory | |
References | (MISC) https://rpm.org/wiki/Releases/4.18.0 - Release Notes, Vendor Advisory | |
References | (MISC) https://github.com/rpm-software-management/rpm/pull/1919 - Patch, Third Party Advisory | |
References | (MISC) https://github.com/rpm-software-management/rpm/commit/96ec957e281220f8e137a2d5eb23b83a6377d556 - Patch, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
26 Aug 2022, 17:17
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-08-26 16:15
Updated : 2023-12-10 14:35
NVD link : CVE-2021-35939
Mitre link : CVE-2021-35939
CVE.ORG link : CVE-2021-35939
JSON object : View
Products Affected
rpm
- rpm
redhat
- enterprise_linux
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')