Summary
[4.16.1.3-27]
- TOCTOU race in checks for unsafe symlinks (CVE-2021-35937)
- races with chown/chmod/capabilities calls during installation (CVE-2021-35938)
- checks for unsafe symlinks are not performed for intermediary directories (CVE-2021-35939)
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | python3-rpm | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-apidocs | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-build | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-build-libs | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-cron | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-devel | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-libs | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-plugin-audit | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-plugin-fapolicyd | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-plugin-ima | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-plugin-selinux | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-plugin-syslog | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-plugin-systemd-inhibit | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-sign | 0:4.16.1.3-27.el9_3 |
| Oracle Linux · 9 | rpm-sign-libs | 0:4.16.1.3-27.el9_3 |
Vulnerabilities 3
-
Unscored —
A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks tha…
-
Unscored —
A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installin…
-
Unscored —
It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the pa…