RHSA-2024:0647: Moderate: rpm security update
Published Feb 1, 2024
·Updated
Moderate: rpm security update
Other sources
The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.Security Fix(es): rpm: TOCTOU race in checks for unsafe symlinks (CVE-2021-35937) rpm: races with chown/chmod/capabilities calls during installation (CVE-2021-35938) rpm: checks for unsafe symlinks are not performed for intermediary directories (CVE-2021-35939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
113 affected componentsFixes available
redhat/rpm<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/python3-rpm<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/python3-rpm-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/python3-rpm-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-apidocs<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-build<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-build-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-build-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-build-libs<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-build-libs<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-build-libs-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-build-libs-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-cron<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-debugsource<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-debugsource<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-devel<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-devel<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-devel-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-devel-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-libs<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-libs<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-libs-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-libs-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-fapolicyd<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-fapolicyd-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-fapolicyd-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-ima<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-ima-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-ima-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-prioreset<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-prioreset-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-prioreset-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-selinux<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-selinux-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-selinux-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-syslog<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-syslog-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-syslog-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-systemd-inhibit<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-systemd-inhibit-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-systemd-inhibit-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-sign<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-sign-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-sign-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/python3-rpm<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-build<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-fapolicyd<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-ima<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-prioreset<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-selinux<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-syslog<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-systemd-inhibit<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-sign<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/python3-rpm<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/python3-rpm-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-build<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-build-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-build-libs<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-build-libs-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-debugsource<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-devel<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-devel-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-libs<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-libs-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-fapolicyd<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-fapolicyd-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-ima<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-ima-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-prioreset<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-prioreset-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-selinux<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-selinux-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-syslog<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-syslog-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-systemd-inhibit<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-plugin-systemd-inhibit-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-sign<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/rpm-sign-debuginfo<4.14.3-28.el8_9
4.14.3-28.el8_9
redhat/python3-rpm<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/python3-rpm-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-build<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-build-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-build-libs<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-build-libs-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-debugsource<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-devel<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-devel-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-libs<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-libs-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-plugin-fapolicyd<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-plugin-fapolicyd-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-plugin-ima<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-plugin-ima-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-plugin-prioreset<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-plugin-prioreset-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-plugin-selinux<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-plugin-selinux-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-plugin-syslog<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-plugin-syslog-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-plugin-systemd-inhibit<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-plugin-systemd-inhibit-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-sign<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
redhat/rpm-sign-debuginfo<4.14.3-28.el8_9.aa
4.14.3-28.el8_9.aa
Red Hat Red Hat Enterprise Linux for Power, little endian
Red Hat Red Hat Enterprise Linux for ARM 64
Red Hat Red Hat Enterprise Linux for IBM z Systems
Remediation
Event History
Feb 1, 2024
Advisory Published
via Red Hat·12:00 AM
Data Sourced
via Red Hat·12:00 AM
RemedyDescriptionAffected Software
Advisory Published
via Red Hat·12:04 PM
Frequently Asked Questions
1
What is the severity of RHSA-2024:0647?
The severity of RHSA-2024:0647 is categorized as moderate.
2
How do I fix RHSA-2024:0647?
To fix RHSA-2024:0647, update to the package version 4.14.3-28.el8_9 or higher.
3
Which software is affected by RHSA-2024:0647?
RHSA-2024:0647 affects various versions of the RPM Package Manager and its associated packages on different architectures.
4
What vulnerability is addressed in RHSA-2024:0647?
RHSA-2024:0647 addresses a TOCTOU race condition vulnerability in checks for unsafe symlinks.
5
Is there a recommended course of action for users impacted by RHSA-2024:0647?
It is recommended that users patch their systems promptly by updating the affected RPM packages.