A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 6.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rpm-plugin-prioresetUpgrade rpm-plugin-auditUpgrade rpm-signUpgrade rpmUpgrade python3-rpmUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-build-libsUpgrade rpm-plugin-selinuxUpgrade rpm-buildUpgrade rpm-develUpgrade rpm-apidocsUpgrade rpm-plugin-fapolicydUpgrade rpm-cronUpgrade rpm-plugin-imaUpgrade rpm-libsUpgrade rpm-plugin-syslogUpgrade rpm-sign-libs | Jan 29, 2024 | Aug 25, 2022 |
| Alpine Linux | — | Upgrade rpm | Aug 22, 2024 | Aug 25, 2022 |
| Amazon_linux_2023 | — | Upgrade rpm-buildUpgrade rpm-build-debuginfoUpgrade rpm-sign-libsUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-build-libsUpgrade rpm-debuginfoUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-audit-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-plugin-selinuxUpgrade rpm-sign-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-plugin-syslogUpgrade rpm-devel-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-apidocsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-sign-libs-debuginfoUpgrade rpm-plugin-auditUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-cronUpgrade rpm-build-libs-debuginfoUpgrade rpm-develUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpmUpgrade python3-rpmUpgrade rpm-debugsourceUpgrade rpm-signUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-prioresetUpgrade rpm-libs | Feb 17, 2025 | Jun 30, 2021 |
| Centos_linux | — | Upgrade rpm-apidocsUpgrade python3-rpm-debuginfoUpgrade rpm-buildUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-build-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-plugin-fapolicydUpgrade rpm-libsUpgrade rpm-sign-libs-debuginfoUpgrade python3-rpmUpgrade rpm-plugin-imaUpgrade rpm-plugin-selinuxUpgrade rpm-cronUpgrade rpm-debugsourceUpgrade rpmUpgrade rpm-plugin-auditUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-sign-libsUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-sign-debuginfoUpgrade rpm-plugin-audit-debuginfoUpgrade rpm-build-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-develUpgrade rpm-sign | Jan 26, 2024 | Aug 25, 2022 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | Aug 25, 2022 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Oct 31, 2022 | Aug 25, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rpm-plugin-systemd-inhibitUpgrade rpm-libsUpgrade rpmUpgrade python3-rpm | Dec 22, 2022 | Aug 25, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rpm-libsUpgrade rpm-plugin-systemd-inhibitUpgrade python3-rpmUpgrade rpm | Nov 15, 2022 | Aug 25, 2022 |
| Oracle_linux | — | Upgrade rpm-plugin-auditUpgrade python3-rpmUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-apidocsUpgrade rpm-plugin-fapolicydUpgrade rpm-cronUpgrade rpm-develUpgrade rpmUpgrade rpm-plugin-imaUpgrade rpm-build-libsUpgrade rpm-plugin-syslogUpgrade rpm-plugin-prioresetUpgrade rpm-sign-libsUpgrade rpm-buildUpgrade rpm-libsUpgrade rpm-plugin-selinuxUpgrade rpm-sign | Jan 25, 2024 | Jun 30, 2021 |
| Redhat Openshift | — | Upgrade windows-machine-config-rhel9-operator | Aug 10, 2026 | Jun 30, 2021 |
| Redhat_linux | — | Upgrade rpm-plugin-systemd-inhibitUpgrade rpm-libsUpgrade rpm-sign-libsUpgrade rpm-build-debuginfoUpgrade rpm-sign-debuginfoUpgrade rpm-plugin-selinuxUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpm-cronUpgrade rpm-sign-libs-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-debugsourceUpgrade rpm-libs-debuginfoUpgrade rpm-build-libsUpgrade rpm-signUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-develUpgrade rpm-plugin-imaUpgrade rpm-plugin-prioresetUpgrade python3-rpmNo solution existsUpgrade rpm-plugin-auditUpgrade rpm-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-apidocsUpgrade python3-rpm-debuginfoUpgrade rpmUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-plugin-audit-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-build | Jan 26, 2024 | Aug 25, 2022 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub