CVE catalog

CVE-2021-35937

rpm: CVE-2021-35937

[CVE catalog]

Severity
Medium · CVSS 6.3CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.33% · Oct 25, 2026

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrpmsid6.1.0-1fixed
Debianrpmforky6.1.0-1fixed
Debianrpmtrixie4.20.1+dfsg-3fixed
Debianrpmbookworm4.18.0+dfsg-1+deb12u1fixed
Ubunturpmpro4.14.2.1+dfsg1-1vulnerable
Ubunturpmpro4.14.2.1+dfsg1-1build1vulnerable
Ubunturpmpro4.14.2.1+dfsg1-1build2vulnerable
Ubunturpmpro4.14.2.1+dfsg1-1ubuntu0.1~esm1vulnerable
Ubunturpm22.044.16.1.2+dfsg1-3ubuntu1vulnerable
Ubunturpm22.044.16.1.2+dfsg1-3ubuntu3vulnerable
Ubunturpm22.044.17.0+dfsg1-1vulnerable
Ubunturpm22.044.17.0+dfsg1-3vulnerable
Ubunturpm22.044.17.0+dfsg1-4vulnerable
Ubunturpm22.044.17.0+dfsg1-4build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrpmsourcesid4.18.0+dfsg-1not yet assignedNot reported[990543]
Debianrpmsourceforky4.18.0+dfsg-1not yet assignedNot reported[990543]
Debianrpmsourcetrixie4.18.0+dfsg-1not yet assignedNot reported[990543]
Debianrpmsourcebookworm4.18.0+dfsg-1not yet assignedNot reported[990543]

[Debian bug #990543]

Notes

[bookworm] rpm: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [librpm9]Fixed

    Source package: [rpm]

    Details (2)

    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [librpmbuild9]Fixed

    Source package: [rpm]

    Details (2)

    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [librpm-dev]Fixed

    Source package: [rpm]

    Details (2)

    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [librpmio9]Fixed

    Source package: [rpm]

    Details (2)

    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [librpmsign9]Fixed

    Source package: [rpm]

    Details (2)

    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [python3-rpm]Fixed

    Source package: [rpm]

    Details (2)

    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [rpm]Fixed
    Details (2)

    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [rpm2cpio]Fixed

    Source package: [rpm]

    Details (2)

    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [rpm-common]Fixed

    Source package: [rpm]

    Details (2)

    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [rpm-i18n]Fixed

    Source package: [rpm]

    Details (2)

    • 4.18.0+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

[Debian 13 (Trixie)]

  • [librpm10]Fixed

    Source package: [rpm]

    Details (2)

    • 4.20.1+dfsg-3 · amd64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

  • [librpmbuild10]Fixed

    Source package: [rpm]

    Details (2)

    • 4.20.1+dfsg-3 · amd64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

  • [librpm-dev]Fixed

    Source package: [rpm]

    Details (2)

    • 4.20.1+dfsg-3 · amd64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

  • [librpmio10]Fixed

    Source package: [rpm]

    Details (2)

    • 4.20.1+dfsg-3 · amd64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

  • [librpmsign10]Fixed

    Source package: [rpm]

    Details (2)

    • 4.20.1+dfsg-3 · amd64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

  • [python3-rpm]Fixed

    Source package: [rpm]

    Details (2)

    • 4.20.1+dfsg-3 · amd64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

  • [rpm]Fixed
    Details (2)

    • 4.20.1+dfsg-3 · amd64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

  • [rpm2cpio]Fixed

    Source package: [rpm]

    Details (2)

    • 4.20.1+dfsg-3 · amd64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

  • [rpm-common]Fixed

    Source package: [rpm]

    Details (2)

    • 4.20.1+dfsg-3 · amd64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

  • [rpm-i18n]Fixed

    Source package: [rpm]

    Details (2)

    • 4.20.1+dfsg-3 · all · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · all · trixie

      Fixed · Fixed: 4.18.0+dfsg-1

      dsa · rpm · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]