CVE-2021-35938

Katalog CVE

CVSS 6.7 · Medium EPSS 0,51%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada rpm, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 6.7 (Medium) menurut NVD.

Deskripsi (NVD)

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Rincian

Terbit di NVD

25 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 42,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2021-35938 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=1964114 issue tracking · advisory vendor
• https://github.com/rpm-software-management/rpm/commit/25a435e90844ea98fe5eb7bef22c1aecf3a9c033 patch · advisory pihak ketiga
• https://github.com/rpm-software-management/rpm/pull/1919 patch · advisory pihak ketiga
• https://bugzilla.suse.com/show_bug.cgi?id=1157880 exploit · issue tracking · advisory pihak ketiga
• https://security.gentoo.org/glsa/202210-22 advisory pihak ketiga
• https://rpm.org/wiki/Releases/4.18.0 release notes