DeutschShown in its original language — a full translation is planned for a future version.
RPM: Mehrere Schwachstellen
view advisory published 2022-08-31
Ein lokaler Angreifer kann mehrere Schwachstellen in RPM ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Dateien zu manipulieren oder sonstige Auswirkungen zu verursachen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-35939US | medium6.7 | — | ||
It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivilege… | ||||
| CVE-2021-35938US | medium6.7 | — | ||
A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to ex… | ||||
| CVE-2021-3521US | medium4.7 | — | ||
There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys p… | ||||
02
references
External citations — patches, advisories, analysis.
- RedHat Security Advisoryexternal
- RedHat Security Advisoryexternal
- Red Hat Security Advisory RHSA-2024:0453 vom 2024-01-25external
- RedHat Security Advisoryexternal
- Red Hat Security Advisory RHSA-2024:0582 vom 2024-01-30external
- Red Hat Security Advisory RHSA-2024:0647 vom 2024-02-01external
- Red Hat Security Advisory RHSA-2024:1383 vom 2024-03-19external
- Red Hat Security Advisory RHSA-2024:1477 vom 2024-03-25external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan