CVE catalog
CVE-2021-35938
rpm: CVE-2021-35938
- Severity
- Medium · CVSS 6.5
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.52% · Oct 25, 2026
A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rpm | sid | 6.1.0-1 | fixed |
| Debian | rpm | forky | 6.1.0-1 | fixed |
| Debian | rpm | trixie | 4.20.1+dfsg-3 | fixed |
| Debian | rpm | bookworm | 4.18.0+dfsg-1+deb12u1 | fixed |
| Opensuse | rpm | tumbleweed | 4.18.0-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rpm | source | sid | 4.18.0+dfsg-1 | not yet assigned | Not reported | [990543] |
| Debian | rpm | source | forky | 4.18.0+dfsg-1 | not yet assigned | Not reported | [990543] |
| Debian | rpm | source | trixie | 4.18.0+dfsg-1 | not yet assigned | Not reported | [990543] |
| Debian | rpm | source | bookworm | 4.18.0+dfsg-1 | not yet assigned | Not reported | [990543] |
| Opensuse | rpm | rpm | tumbleweed | 4.18.0-1.1 | Not reported | OPENSUSE-SU-2024:12562-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [librpmbuild10]Unknown
Source package: [rpm]
Details (1)
4.20.1-10.1· x86_64 · tumbleweedUnknown · Fixed:
4.18.0-1.1Version impact unknown
dsa · rpm · opensuse · tumbleweed
- [rpm-32bit]Unknown
Source package: [rpm]
Details (1)
4.20.1-10.1· x86_64 · tumbleweedUnknown · Fixed:
4.18.0-1.1Version impact unknown
dsa · rpm · opensuse · tumbleweed
- [rpm-build]Unknown
Source package: [rpm]
Details (1)
4.20.1-10.1· x86_64 · tumbleweedUnknown · Fixed:
4.18.0-1.1Version impact unknown
dsa · rpm · opensuse · tumbleweed
- [rpm-devel]Unknown
Source package: [rpm]
Details (1)
4.20.1-10.1· x86_64 · tumbleweedUnknown · Fixed:
4.18.0-1.1Version impact unknown
dsa · rpm · opensuse · tumbleweed
- [rpm-plugin-fapolicyd]Unknown
Source package: [rpm]
Details (1)
4.20.1-10.1· x86_64 · tumbleweedUnknown · Fixed:
4.18.0-1.1Version impact unknown
dsa · rpm · opensuse · tumbleweed
- [rpm-plugin-ima]Unknown
Source package: [rpm]
Details (1)
4.20.1-10.1· x86_64 · tumbleweedUnknown · Fixed:
4.18.0-1.1Version impact unknown
dsa · rpm · opensuse · tumbleweed
- [rpm-plugin-prioreset]Unknown
Source package: [rpm]
Details (1)
4.20.1-10.1· x86_64 · tumbleweedUnknown · Fixed:
4.18.0-1.1Version impact unknown
dsa · rpm · opensuse · tumbleweed
- [rpm-plugin-selinux]Unknown
Source package: [rpm]
Details (1)
4.20.1-10.1· x86_64 · tumbleweedUnknown · Fixed:
4.18.0-1.1Version impact unknown
dsa · rpm · opensuse · tumbleweed
- [rpm-plugin-syslog]Unknown
Source package: [rpm]
Details (1)
4.20.1-10.1· x86_64 · tumbleweedUnknown · Fixed:
4.18.0-1.1Version impact unknown
dsa · rpm · opensuse · tumbleweed
- [rpm-plugin-unshare]Unknown
Source package: [rpm]
Details (1)
4.20.1-10.1· x86_64 · tumbleweedUnknown · Fixed:
4.18.0-1.1Version impact unknown
dsa · rpm · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [librpm9]Fixed
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [librpmbuild9]Fixed
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [librpm-dev]Fixed
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [librpmio9]Fixed
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [librpmsign9]Fixed
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [python3-rpm]Fixed
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [rpm]Fixed
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [rpm2cpio]Fixed
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [rpm-common]Fixed
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [rpm-i18n]Fixed
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· all · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· all · bookwormFixed · Fixed:
4.18.0+dfsg-1dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
Observed:
References
- [https://access.redhat.com/errata/RHSA-2024:0424]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_12562-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2021-35938]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12562-1]
- [https://security-tracker.debian.org/tracker/CVE-2021-35938]
- [https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1243.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]