Red Hat Security Advisory

RHSA-2024:0647

rpm security update

Released 2024-02-01 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) rpm-build-4.14.3-28.el8_9, rpm-plugin-fapolicyd-4.14.3-28.el8_9
Red Hat Enterprise Linux BaseOS (v. 8) python3-rpm-4.14.3-28.el8_9, rpm-4.14.3-28.el8_9, rpm-apidocs-4.14.3-28.el8_9 +10

Fixes 3 records

TI-2021-14394 CVE-2021-35939 · GHSA-prgv-w33h-5m73

Link following in RPM

LOW 30

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00508 Published 2022-08-26 Partial fix CWE-59

TI-2021-14393 CVE-2021-35938 · GHSA-83gm-5269-qr3v

Link following in RPM

LOW 30

A symbolic link issue was found in rpm.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00519 Published 2022-08-25 Partial fix CWE-59

TI-2021-14392 CVE-2021-35937 · GHSA-63x9-9q4w-j636

Link following in RPM

LOW 28

A race condition vulnerability was found in rpm.

CVSS 3.1MEDIUM 6.4 Local High privileges No interaction EPSS 0.00325 Published 2022-08-25 Partial fix CWE-59