CVE-2021-35937

Katalog CVE

CVSS 6.4 · Medium EPSS 0,32%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada rpm, redhat enterprise linux +1 lainnya. Skor CVSS 3.1 6.4 (Medium) menurut NVD.

Deskripsi (NVD)

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Rincian

Terbit di NVD

25 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.4 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2021-35937 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=1964125 issue tracking · patch · advisory vendor
• https://security.gentoo.org/glsa/202210-22 advisory pihak ketiga
• https://www.usenix.org/legacy/event/sec05/tech/full_papers/borisov/borisov.pdf exploit · deskripsi teknis · advisory pihak ketiga
• https://rpm.org/wiki/Releases/4.18.0 release notes