It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rpm-cronUpgrade rpm-libsUpgrade python3-rpmUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-auditUpgrade rpm-plugin-prioresetUpgrade rpm-develUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-signUpgrade rpm-build-libsUpgrade rpm-apidocsUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-syslogUpgrade rpmUpgrade rpm-plugin-imaUpgrade rpm-buildUpgrade rpm-sign-libs | Jan 29, 2024 | Aug 26, 2022 |
| Alpine Linux | — | Upgrade rpm | Aug 22, 2024 | Aug 26, 2022 |
| Amazon_linux_2023 | — | Upgrade rpm-plugin-selinux-debuginfoUpgrade rpm-develUpgrade rpm-debugsourceUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-build-libsUpgrade rpm-sign-libsUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-audit-debuginfoUpgrade rpm-sign-debuginfoUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-auditUpgrade rpm-apidocsUpgrade rpm-plugin-prioresetUpgrade rpm-libs-debuginfoUpgrade rpm-signUpgrade rpm-plugin-prioreset-debuginfoUpgrade python3-rpmUpgrade rpm-buildUpgrade rpm-libsUpgrade rpm-build-debuginfoUpgrade rpm-debuginfoUpgrade rpm-cronUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpmUpgrade rpm-plugin-syslogUpgrade rpm-plugin-imaUpgrade rpm-build-libs-debuginfoUpgrade rpm-sign-libs-debuginfo | Feb 17, 2025 | Jun 30, 2021 |
| Centos_linux | — | Upgrade rpm-apidocsUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-cronUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-debugsourceUpgrade rpm-build-libs-debuginfoUpgrade rpm-sign-libs-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-plugin-selinuxUpgrade rpm-sign-libsUpgrade rpm-build-debuginfoUpgrade rpm-libsUpgrade rpm-plugin-auditUpgrade rpm-sign-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-signUpgrade python3-rpm-debuginfoUpgrade python3-rpmUpgrade rpm-build-libsUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-plugin-imaUpgrade rpmUpgrade rpm-develUpgrade rpm-debuginfoUpgrade rpm-plugin-audit-debuginfoUpgrade rpm-build | Jan 26, 2024 | Aug 26, 2022 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | Aug 26, 2022 |
| Freebsd | — | Upgrade rpm4 | Dec 2, 2022 | Dec 1, 2022 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Oct 31, 2022 | Aug 26, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-rpmUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-libsUpgrade rpm | Dec 22, 2022 | Aug 26, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rpm-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpmUpgrade python3-rpm | Nov 15, 2022 | Aug 26, 2022 |
| Oracle_linux | — | Upgrade rpm-apidocsUpgrade python3-rpmUpgrade rpm-plugin-imaUpgrade rpm-plugin-syslogUpgrade rpmUpgrade rpm-buildUpgrade rpm-signUpgrade rpm-plugin-auditUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-fapolicydUpgrade rpm-libsUpgrade rpm-cronUpgrade rpm-plugin-prioresetUpgrade rpm-sign-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-develUpgrade rpm-build-libs | Jan 25, 2024 | Jun 30, 2021 |
| Redhat Openshift | — | Upgrade windows-machine-config-rhel9-operator | Aug 10, 2026 | Jun 30, 2021 |
| Redhat_linux | — | Upgrade rpm-plugin-audit-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-debugsourceUpgrade rpm-build-libsUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-prioresetUpgrade rpm-apidocsUpgrade rpm-build-debuginfoUpgrade rpm-libsUpgrade rpm-sign-debuginfoUpgrade rpm-sign-libsUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-sign-libs-debuginfoUpgrade rpm-devel-debuginfoUpgrade rpm-plugin-selinuxUpgrade rpm-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-syslogUpgrade python3-rpmUpgrade rpm-develUpgrade rpm-signUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpm-cronNo solution existsUpgrade rpmUpgrade rpm-buildUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-plugin-audit | Jan 26, 2024 | Aug 26, 2022 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 26, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub