This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-35937 →

DEBIAN-CVE-2021-35937

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response t...

Original description

The description as published by the source.

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 rpm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0+dfsg-1"}]}]

Debian:13 rpm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0+dfsg-1"}]}]

Debian:14 rpm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0+dfsg-1"}]}]

References

advisory security-tracker.debian.org