CVE-2021-35939
Summary
| CVE | CVE-2021-35939 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-08-26 16:15:00 UTC |
|---|
| Updated | 2023-02-04 01:16:00 UTC |
|---|
| Description | It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Validate intermediate symlinks during installation, CVE-2021-35939 · rpm-software-management/rpm@96ec957 · GitHub |
MISC |
github.com |
|
| Red Hat Customer Portal - Access to 24x7 support and knowledge |
MISC |
access.redhat.com |
|
| rpm.org - Releases |
MISC |
rpm.org |
|
| 1964129 – (CVE-2021-35939) CVE-2021-35939 rpm: checks for unsafe symlinks are not performed for intermediary directories |
MISC |
bugzilla.redhat.com |
|
| RPM: Multiple Vulnerabilities (GLSA 202210-22) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| First steps towards fixing the symlink CVEs by pmatilai · Pull Request #1919 · rpm-software-management/rpm · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 161314 Oracle Enterprise Linux Security Update for rpm (ELSA-2024-0463)
- 161331 Oracle Enterprise Linux Security Update for rpm (ELSA-2024-0647)
- 182935 Debian Security Update for rpm (CVE-2021-35939)
- 242744 Red Hat Update for rpm (RHSA-2024:0424)
- 242754 Red Hat Update for rpm (RHSA-2024:0463)
- 242757 Red Hat Update for rpm (RHSA-2024:0435)
- 242810 Red Hat Update for rpm (RHSA-2024:0582)
- 242816 Red Hat Update for rpm (RHSA-2024:0647)
- 242842 Red Hat Update for rpm (RHSA-2024:0453)
- 357349 Amazon Linux Security Advisory for rpm : ALAS2023-2024-573
- 379634 Alibaba Cloud Linux Security Update for rpm (ALINUX3-SA-2024:0030)
- 502949 Alpine Linux Security Update for rpm
- 505818 Alpine Linux Security Update for rpm
- 672363 EulerOS Security Update for rpm (EulerOS-SA-2022-2741)
- 672374 EulerOS Security Update for rpm (EulerOS-SA-2022-2776)
- 672457 EulerOS Security Update for rpm (EulerOS-SA-2022-2829)
- 672471 EulerOS Security Update for rpm (EulerOS-SA-2022-2855)
- 691000 Free Berkeley Software Distribution (FreeBSD) Security Update for rpm4 (0c52abde-717b-11ed-98ca-40b034429ecf)
- 710651 Gentoo Linux RPM Multiple Vulnerabilities (GLSA 202210-22)
- 903739 Common Base Linux Mariner (CBL-Mariner) Security Update for rpm (10784)
- 903833 Common Base Linux Mariner (CBL-Mariner) Security Update for rpm (10769)
- 904122 Common Base Linux Mariner (CBL-Mariner) Security Update for rpm (10769-1)
- 941549 AlmaLinux Security Update for rpm (ALSA-2024:0463)
- 941568 AlmaLinux Security Update for rpm (ALSA-2024:0647)
- 961111 Rocky Linux Security Update for rpm (RLSA-2024:0647)
