RPM
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2021-35939 | Fixed in RPM-v4.18 | It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the | MEDIUM 6.7 | 0.5 % | ||
| CVE-2021-35938 | Fixed in rpm v4.18.0 | A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unp | MEDIUM 6.7 | 0.5 % | ||
| CVE-2021-35937 | Fixed in rpm v4.18.0 | A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in | MEDIUM 6.4 | 0.3 % | ||
| CVE-2021-3521 | Fixed in rpm-4.18.0-beta1, rpm-4.18.0-alpha2, rpm-4.18.0-alpha1 . | There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not | MEDIUM 4.7 | 0.3 % | ||
| CVE-2021-3421 | rpm 4.17.0-alpha | A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly | MEDIUM 5.5 | 0.6 % | ||
| CVE-2021-20266 | rpm 4.17.0 | A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds rea | MEDIUM 4.9 | 1.6 % | ||
| CVE-2021-20271 | all versions | A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim | HIGH 7.0 | 0.8 % |