PT-2021-3509 · Red Hat+6 · Red Hat+6

Msiddiqu · Published 2021-06-30 · Updated 2024-06-15 · CVE-2021-35939

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Linux (affected versions not specified)

Description The issue is related to the RPM package manager in Red Hat Enterprise Linux, where there is an incorrect link resolution before accessing a file. This can allow an attacker to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALSA-2024:0463

ALSA-2024:0647

ALT-PU-2021-2518

ALT-PU-2021-2600

AZL-10769

BDU:2021-03558

CESA-2024_0647

CVE-2021-35939

OESA-2022-1897

OPENSUSE-SU-2024:12562-1

RHSA-2024:0424

RHSA-2024:0435

RHSA-2024:0453

RHSA-2024:0463

RHSA-2024:0582

RHSA-2024:0647

RHSA-2024_0463

RHSA-2024_0647

RLSA-2024:0647

Affected Products

Alt Linux

Almalinux

Centos

Debian

Red Hat

Red Os

Rocky Linux

References · 47

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1964129 · Exploit
• https://github.com/rpm-software-management/rpm/pull/1919 · Patch
• https://github.com/rpm-software-management/rpm/commit/96ec957e281220f8e137a2d5eb23b83a6377d556 · Patch
• https://osv.dev/vulnerability/AZL-10769 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35939 · Security Note
• https://linux.oracle.com/errata/ELSA-2024-0463.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:0647 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35939 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12562-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35937 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-35939 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-35939 · Vendor Advisory
• https://security.gentoo.org/glsa/202210-22 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1897 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory