CVE-2021-35937

Source
https://nvd.nist.gov/vuln/detail/CVE-2021-35937
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-35937.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-35937
Downstream
Related
Published
2022-08-25T20:15:09Z
Modified
2025-09-19T13:05:55.894174Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

References

Affected packages

Git / github.com/rpm-software-management/rpm

Affected ranges

Type
GIT
Repo
https://github.com/rpm-software-management/rpm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

rpm-4.*

rpm-4.11.0-alpha
rpm-4.12.0-alpha
rpm-4.13.0-alpha
rpm-4.15.0-alpha
rpm-4.16.0-alpha
rpm-4.17.0-alpha
rpm-4.18.0-alpha1
rpm-4.18.0-alpha2
rpm-4.18.0-beta1
rpm-4.18.0-rc1
rpm-4.4-release
rpm-4.4.1-release
rpm-4.4.2-release
rpm-4.4.2.1-rc1
rpm-4.4.2.1-rc2
rpm-4.8.0-beta1