Ubuntu.comUB:CVE-2021-35938CVE-2021-35938
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
32.1%
A symbolic link issue was found in rpm. It occurs when rpm sets the desired
permissions and credentials after installing a file. A local unprivileged
user could use this flaw to exchange the original file with a symbolic link
to a security-critical file and escalate their privileges on the system.
The highest threat from this vulnerability is to data confidentiality and
integrity as well as system availability.
Notes
| Author | Note |
|---|---|
| seth-arnold | Only debugedit and librpmio9 binary packages are in main, and triaged with view to how they are used in the build process as described in https://bugs.launchpad.net/ubuntu/+source/rpm/+bug/1913871 |
Related
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
32.1%