It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rpm-buildUpgrade rpm-apidocsUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-syslogUpgrade rpmUpgrade rpm-sign-libsUpgrade rpm-plugin-imaUpgrade rpm-build-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-libsUpgrade rpm-cronUpgrade rpm-signUpgrade rpm-plugin-prioresetUpgrade rpm-develUpgrade python3-rpmUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-audit | Jan 29, 2024 | Aug 26, 2022 |
| Alpine Linux | — | Upgrade rpm | Aug 22, 2024 | Aug 26, 2022 |
| Amazon_linux_2023 | — | Upgrade rpm-debuginfoUpgrade rpm-build-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-cronUpgrade rpm-devel-debuginfoUpgrade rpm-libsUpgrade rpm-buildUpgrade rpm-plugin-syslogUpgrade rpmUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-sign-libs-debuginfoUpgrade rpm-plugin-ima-debuginfoUpgrade python3-rpmUpgrade rpm-develUpgrade rpm-apidocsUpgrade rpm-debugsourceUpgrade rpm-plugin-systemd-inhibitUpgrade python3-rpm-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-build-libsUpgrade rpm-plugin-audit-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-sign-debuginfoUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-signUpgrade rpm-plugin-prioresetUpgrade rpm-sign-libsUpgrade rpm-plugin-audit | Feb 17, 2025 | Jun 30, 2021 |
| Centos_linux | — | Upgrade rpm-plugin-audit-debuginfoUpgrade rpm-plugin-syslogUpgrade rpm-develUpgrade python3-rpmUpgrade rpm-debuginfoUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-signUpgrade rpmUpgrade rpm-buildUpgrade rpm-devel-debuginfoUpgrade rpm-build-libsUpgrade rpm-sign-debuginfoUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-apidocsUpgrade rpm-sign-libs-debuginfoUpgrade rpm-cronUpgrade rpm-build-libs-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-debugsourceUpgrade rpm-plugin-selinuxUpgrade rpm-libsUpgrade rpm-build-debuginfoUpgrade rpm-sign-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-plugin-auditUpgrade rpm-libs-debuginfo | Jan 26, 2024 | Aug 26, 2022 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | Aug 26, 2022 |
| Freebsd | — | Upgrade rpm4 | Dec 2, 2022 | Dec 1, 2022 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Oct 31, 2022 | Aug 26, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rpmUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-libsUpgrade python3-rpm | Dec 22, 2022 | Aug 26, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rpm-libsUpgrade rpm-plugin-systemd-inhibitUpgrade rpmUpgrade python3-rpm | Nov 15, 2022 | Aug 26, 2022 |
| Oracle_linux | — | Upgrade rpmUpgrade rpm-buildUpgrade rpm-plugin-imaUpgrade rpm-plugin-syslogUpgrade python3-rpmUpgrade rpm-apidocsUpgrade rpm-sign-libsUpgrade rpm-libsUpgrade rpm-develUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-build-libsUpgrade rpm-signUpgrade rpm-plugin-auditUpgrade rpm-cronUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-prioreset | Jan 25, 2024 | Jun 30, 2021 |
| Redhat Openshift | — | Upgrade windows-machine-config-rhel9-operator | Aug 10, 2026 | Jun 30, 2021 |
| Redhat_linux | — | Upgrade rpm-buildUpgrade python3-rpmUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-plugin-syslog-debuginfoUpgrade rpmUpgrade rpm-plugin-fapolicydUpgrade rpm-plugin-ima-debuginfoNo solution existsUpgrade rpm-cronUpgrade rpm-plugin-syslogUpgrade rpm-plugin-auditUpgrade rpm-signUpgrade rpm-develUpgrade rpm-sign-libsUpgrade rpm-devel-debuginfoUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-plugin-imaUpgrade rpm-build-libs-debuginfoUpgrade python3-rpm-debuginfoUpgrade rpm-plugin-selinuxUpgrade rpm-apidocsUpgrade rpm-plugin-prioresetUpgrade rpm-build-debuginfoUpgrade rpm-libsUpgrade rpm-sign-debuginfoUpgrade rpm-build-libsUpgrade rpm-debugsourceUpgrade rpm-debuginfoUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-sign-libs-debuginfoUpgrade rpm-plugin-audit-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-libs-debuginfo | Jan 26, 2024 | Aug 26, 2022 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 26, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub