A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

🗓️ 01 Sep 2022 07:00:00Reported by MicrosoftType

Symbolic link flaw in rpm enables unprivileged users to replace installed files with links to privileged files, enabling escalation.

Reporter	Title	Published	Views	Family All 115
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to an Improper Link Resolution Before File Access in the RHEL UBI (CVE-2021-35938)	5 Aug 202419:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified with the DS8900F and DS8A00 Hardware Management Console (HMC)	27 May 202523:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	18 Aug 202514:19	–	ibm
IBM Security Bulletins	Security Bulletin: App Connect Enterprise Certified Container UBI updates	7 Mar 202414:53	–	ibm
FreeBSD	rpm4 -- Multiple Vulnerabilities	22 Aug 202200:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : python3-rpm, rpm, rpm-apidocs (ALAS2023-2024-573)	21 Mar 202400:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0030: rpm (ALINUX3-SA-2024:0030)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : rpm (ALSA-2024:0463)	26 Jan 202400:00	–	nessus
Tenable Nessus	AlmaLinux 8 : rpm (ALSA-2024:0647)	2 Feb 202400:00	–	nessus
Tenable Nessus	CentOS 8 : rpm (CESA-2024:0647)	1 Feb 202400:00	–	nessus