Description
It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | rpm | before 4.13.0.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rpm | No fix yet | — |
| Debian 13 | rpm | No fix yet | — |
| Debian 12 | rpm | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | rpm | No fix yet | — |
| Ubuntu Pro 14.04 LTS | rpm | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | rpm +2 | 4.11.2-16.21.1 | SUSE-SU-2018:3884-1 |
| SLES 12 SP3 | rpm +2 | 4.11.2-16.16.1 | SUSE-SU-2018:3884-1, SUSE-SU-2018:3286-1 |
| SLES 12 SP2 | rpm +2 | 4.11.2-16.21.1 | SUSE-SU-2018:3884-1 |
| SLES 12 SP1 | rpm +2 | 4.11.2-16.21.1 | SUSE-SU-2018:3884-1 |
| SLES 12 | rpm +2 | 4.11.2-16.21.1 | SUSE-SU-2018:3884-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP4 | rpm +2 | 4.11.2-16.21.1 | SUSE-SU-2018:3884-1 |
| SLES for SAP 12 SP3 | rpm +2 | 4.11.2-16.16.1 | SUSE-SU-2018:3884-1, SUSE-SU-2018:3286-1 |
| SLES for SAP 12 SP2 | rpm +2 | 4.11.2-16.21.1 | SUSE-SU-2018:3884-1 |
| SLES for SAP 12 SP1 | rpm +2 | 4.11.2-16.21.1 | SUSE-SU-2018:3884-2 |
| SUSE OpenStack Cloud 7 | rpm +2 | 4.11.2-16.21.1 | SUSE-SU-2018:3884-1 |
| SUSE Enterprise Storage 4 | rpm +2 | 4.11.2-16.21.1 | SUSE-SU-2018:3884-1 |
Advisories 4
- SUSE-SU-2018:3884-1 Security update for rpm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3884-2 Security update for rpm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3286-1 Security update for rpm SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0876 RPM: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Apr 11, 2024
References
- GLSA-201811-22 vendor-advisory
- https://github.com/rpm-software-management/rpm/commit/404ef011c300207cdb1e531670384564aae04bdc
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 mailing-list
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 mailing-list