A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 6.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rpmUpgrade rpm-signUpgrade rpm-plugin-auditUpgrade rpm-plugin-prioresetUpgrade rpm-build-libsUpgrade python3-rpmUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-buildUpgrade rpm-develUpgrade rpm-sign-libsUpgrade rpm-plugin-syslogUpgrade rpm-plugin-imaUpgrade rpm-plugin-fapolicydUpgrade rpm-apidocsUpgrade rpm-cronUpgrade rpm-libsUpgrade rpm-plugin-selinux | Jan 29, 2024 | Aug 25, 2022 |
| Alpine Linux | — | Upgrade rpm | Aug 22, 2024 | Aug 25, 2022 |
| Amazon_linux_2023 | — | Upgrade rpm-libs-debuginfoUpgrade rpm-sign-debuginfoUpgrade rpm-sign-libsUpgrade rpm-debuginfoUpgrade rpm-build-libsUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-devel-debuginfoUpgrade rpm-build-debuginfoUpgrade rpm-plugin-audit-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-buildUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-selinuxUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-plugin-auditUpgrade rpm-debugsourceUpgrade rpm-plugin-fapolicydUpgrade rpm-signUpgrade rpm-develUpgrade rpmUpgrade rpm-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-build-libs-debuginfoUpgrade rpm-apidocsUpgrade rpm-sign-libs-debuginfoUpgrade python3-rpmUpgrade rpm-plugin-prioresetUpgrade rpm-cronUpgrade rpm-plugin-selinux-debuginfo | Feb 17, 2025 | Jun 30, 2021 |
| Centos_linux | — | Upgrade rpm-plugin-audit-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-build-libsUpgrade rpm-sign-debuginfoUpgrade rpm-develUpgrade rpm-sign-libsUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-plugin-auditUpgrade rpm-debugsourceUpgrade rpm-libs-debuginfoUpgrade rpmUpgrade rpm-signUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-cronUpgrade rpm-libsUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpm-build-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-apidocsUpgrade rpm-sign-libs-debuginfoUpgrade rpm-plugin-ima-debuginfoUpgrade python3-rpmUpgrade rpm-plugin-syslogUpgrade rpm-plugin-imaUpgrade rpm-buildUpgrade rpm-debuginfoUpgrade rpm-build-libs-debuginfo | Jan 26, 2024 | Aug 25, 2022 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | Aug 25, 2022 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Oct 31, 2022 | Aug 25, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-rpmUpgrade rpmUpgrade rpm-libsUpgrade rpm-plugin-systemd-inhibit | Dec 22, 2022 | Aug 25, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rpm-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpmUpgrade python3-rpm | Nov 15, 2022 | Aug 25, 2022 |
| Oracle_linux | — | Upgrade rpm-plugin-auditUpgrade rpm-plugin-fapolicydUpgrade rpm-develUpgrade rpmUpgrade rpm-apidocsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-cronUpgrade python3-rpmUpgrade rpm-signUpgrade rpm-plugin-prioresetUpgrade rpm-sign-libsUpgrade rpm-libsUpgrade rpm-plugin-syslogUpgrade rpm-plugin-imaUpgrade rpm-plugin-selinuxUpgrade rpm-buildUpgrade rpm-build-libs | Jan 25, 2024 | Jun 30, 2021 |
| Redhat Openshift | — | Upgrade windows-machine-config-rhel9-operator | Aug 10, 2026 | Jun 30, 2021 |
| Redhat_linux | — | Upgrade python3-rpm-debuginfoUpgrade rpmUpgrade rpm-buildUpgrade rpm-plugin-imaNo solution existsUpgrade rpm-develUpgrade rpm-plugin-auditUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-plugin-prioresetUpgrade python3-rpmUpgrade rpm-debuginfoUpgrade rpm-apidocsUpgrade rpm-plugin-audit-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-sign-libsUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-selinuxUpgrade rpm-sign-debuginfoUpgrade rpm-debugsourceUpgrade rpm-libs-debuginfoUpgrade rpm-libsUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-sign-libs-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpm-build-libsUpgrade rpm-signUpgrade rpm-build-libs-debuginfoUpgrade rpm-cronUpgrade rpm-build-debuginfo | Jan 26, 2024 | Aug 25, 2022 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub