Search for vulnerabilities
Vulnerability details: VCID-dxy8-89jf-aaap
Vulnerability ID VCID-dxy8-89jf-aaap
Aliases CVE-2021-35938
Summary A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Status Published
Exploitability 0.5
Weighted Severity 7.0
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-59 Improper Link Resolution Before File Access ('Link Following')
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-35938.json
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2021-35938
cvssv3.1 6.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 6.7 https://nvd.nist.gov/vuln/detail/CVE-2021-35938
cvssv3 7.8 https://nvd.nist.gov/vuln/detail/CVE-2021-35938
cvssv3.1 6.7 https://nvd.nist.gov/vuln/detail/CVE-2021-35938
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-35938.json
https://access.redhat.com/security/cve/CVE-2021-35938
https://api.first.org/data/v1/epss?cve=CVE-2021-35938
https://bugzilla.redhat.com/show_bug.cgi?id=1964114
https://bugzilla.suse.com/show_bug.cgi?id=1157880
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35938
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/rpm-software-management/rpm/commit/25a435e90844ea98fe5eb7bef22c1aecf3a9c033
https://github.com/rpm-software-management/rpm/pull/1919
https://rpm.org/wiki/Releases/4.18.0
https://security.gentoo.org/glsa/202210-22
990543 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990543
cpe:2.3:a:rpm:rpm:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:rpm:rpm:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
CVE-2021-35938 https://nvd.nist.gov/vuln/detail/CVE-2021-35938
RHSA-2024:0424 https://access.redhat.com/errata/RHSA-2024:0424
RHSA-2024:0435 https://access.redhat.com/errata/RHSA-2024:0435
RHSA-2024:0453 https://access.redhat.com/errata/RHSA-2024:0453
RHSA-2024:0463 https://access.redhat.com/errata/RHSA-2024:0463
RHSA-2024:0582 https://access.redhat.com/errata/RHSA-2024:0582
RHSA-2024:0647 https://access.redhat.com/errata/RHSA-2024:0647
RHSA-2024:1383 https://access.redhat.com/errata/RHSA-2024:1383
RHSA-2024:1477 https://access.redhat.com/errata/RHSA-2024:1477
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-35938.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-35938
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-35938
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-35938
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.33313
EPSS Score 0.00075
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.