Description
It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | RPM | Fixed in RPM-v4.18 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rpm | 4.18.0+dfsg-1 | — |
| Debian 13 | rpm | 4.18.0+dfsg-1 | — |
| Debian 12 | rpm | 4.18.0+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rpm | No fix yet | — |
| Ubuntu 26.04 LTS | rpm | No fix yet | — |
| Ubuntu 25.10 | rpm | No fix yet | — |
| Ubuntu 24.04 LTS | rpm | No fix yet | — |
| Ubuntu 22.04 LTS | rpm | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | rpm | No fix yet | — |
| Ubuntu Pro 18.04 LTS | rpm | No fix yet | — |
| Ubuntu Pro 16.04 LTS | rpm | No fix yet | — |
| Ubuntu Pro 14.04 LTS | rpm | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | rpm +15 | 4.16.1.3-27.el9_3 | RHSA-2024:0463 |
| RHEL 8 | rpm +14 | 4.14.3-28.el8_9 | RHSA-2024:0647 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | rpm +15 | 4.16.1.3-24.el9_2 | RHSA-2024:0453 |
| RHEL 9.0 EUS | rpm +15 | 4.16.1.3-14.el9_0.1 | RHSA-2024:0435 |
| RHEL 8.8 EUS | rpm +14 | 4.14.3-28.el8_8 | RHSA-2024:0582 |
| RHEL 8.6 EUS | rpm +14 | 4.14.3-26.el8_6 | RHSA-2024:0424 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | rpm +15 | 4.16.1.3-27.el9_3 | ALSA-2024:0463 |
| AlmaLinux 8 | rpm +14 | 4.14.3-28.el8_9 | ALSA-2024:0647 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | rpm | 4.14.3-28.el8_9 | RLSA-2024:0647 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rpm | 4.18.0-1.1 | openSUSE-SU-2024:12562-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | rpm | 4.18.0-r0 | — |
| Alpine v3.23 | rpm | 4.18.0-r0 | — |
| Alpine v3.22 | rpm | 4.18.0-r0 | — |
| Alpine v3.21 | rpm | 4.18.0-r0 | — |
| Alpine v3.20 | rpm | 4.18.0-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | rpm | 4.18.0-r0 | — |
| Alpine v3.18 | rpm | 4.18.0-r0 | — |
| Alpine v3.17 | rpm | 4.18.0-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | rpm +16 | 4.16.1.3-29.amzn2023.0.6 | ALAS2023-2024-573 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | rpm | 4.18.0-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | rpm +15 | 4.16.1.3-27.el9_3 | ELSA-2024-0463 |
| Oracle Linux 8 | rpm +14 | 4.14.3-28.0.2.el8_9 | ELSA-2024-0647 |
Advisories 14
- ALSA-2024:0463 Moderate: rpm security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0647 Moderate: rpm security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:0647 Red Hat Security Advisory: rpm security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2024:0582 Red Hat Security Advisory: rpm security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2024:0453 Red Hat Security Advisory: rpm security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2024:0463 Red Hat Security Advisory: rpm security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2024:0435 Red Hat Security Advisory: rpm security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2024:0424 Red Hat Security Advisory: rpm security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RLSA-2024:0647 Moderate: rpm security update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2024:12562-1 librpmbuild9-4.18.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-1243 RPM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 4, 2025
- ALAS2023-2024-573 Moderate: rpm security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 21, 2024
- ELSA-2024-0647 Moderate: rpm security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 2, 2024
- ELSA-2024-0463 Moderate: rpm security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jan 25, 2024
References
- https://rpm.org/wiki/Releases/4.18.0
- https://github.com/rpm-software-management/rpm/pull/1919
- https://bugzilla.redhat.com/show_bug.cgi?id=1964129
- https://github.com/rpm-software-management/rpm/commit/96ec957e281220f8e137a2d5eb23b83a6377d556
- https://access.redhat.com/security/cve/CVE-2021-35939
- GLSA-202210-22 vendor-advisory