Is CVE-2021-35937 in the CISA KEV catalog?

No. CVE-2021-35937 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2021-35937?

CVE-2021-35937 has a CVSS v3 base score of 6.4 (MEDIUM).

What is the EPSS score for CVE-2021-35937?

CVE-2021-35937 has an EPSS score of 0.31% (23th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2021-35937?

Upgrade rpm on debian 12 to 4.18.0+dfsg-1 or later. Fixes are available for 97 affected products.

CVE & CISA-KEV Catalog

CVE-2021-35937

MEDIUM

6.4

CVSS v3

NVD

Description

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CWE-59Link Following CWE-367TOCTOU Race Condition

How to fix

Remediation Available

rpmDebian

Fixed in:4.18.0+dfsg-1CVE-2021-35937

odf4/cephcsiRocky

Fixed in:rhel9@sha256:5e262fe96badcdebcf0fc40e07acecd607b83a3d48fb90b05bc89ebe790add14_amd64RHSA-2024:1383

Fixed in:rhel9@sha256:765e623f5b4de11f0482f3abde344df4946665046c9190293a0ae9a5d0d62cd2_s390xRHSA-2024:1383

Fixed in:rhel9@sha256:b4b66a42eb728b46ff977431fd07be976d465680f49516dac3f433cdd12e4dbc_ppc64leRHSA-2024:1383

odf4/cephcsiRed Hat / RHEL

Fixed in:rhel9@sha256:765e623f5b4de11f0482f3abde344df4946665046c9190293a0ae9a5d0d62cd2_s390xRHSA-2024:1383

Fixed in:rhel9@sha256:b4b66a42eb728b46ff977431fd07be976d465680f49516dac3f433cdd12e4dbc_ppc64leRHSA-2024:1383

Fixed in:rhel9@sha256:5e262fe96badcdebcf0fc40e07acecd607b83a3d48fb90b05bc89ebe790add14_amd64RHSA-2024:1383

odf4/mcgRed Hat / RHEL

Fixed in:operator-bundle@sha256:3303677bc0ba2cc5e3f55ae313b516f32378b67a20389f69e09e2c3a9738a87d_s390xRHSA-2024:1383

Fixed in:rhel9-operator@sha256:d04a5a9748ac34459c21d4d10efcc9318220c7ceeeb15c41c56cae9bfbb44872_arm64RHSA-2024:1383

Fixed in:rhel9-operator@sha256:94f6dded2ff421275b26d147e35d33e383f06ecb04cd0a618d8b4c5046d0e307_ppc64leRHSA-2024:1383

Fixed in:core-rhel9@sha256:b0eece2979587d7884f8707a6026e28a4aa7a3d96646b01249a9e351acf6b935_ppc64leRHSA-2024:1383

Fixed in:operator-bundle@sha256:98fb1b9309d82c663d3118d19fe776de51a277c474a42bf249fdf075f6993bc4_ppc64leRHSA-2024:1383

Fixed in:core-rhel9@sha256:31d951727244d235e62aed00d1121c6f8da4b9d22e895dcfdc814a8545442dac_s390xRHSA-2024:1383

Fixed in:core-rhel9@sha256:f98634a0fa2517efb383bf6c2a4809f150408225875d7425e64a339209d72e32_amd64RHSA-2024:1383

Fixed in:operator-bundle@sha256:19c29de2cf31f95e5f363064095602656355879eb19c778a8655083cebd54ce6_amd64RHSA-2024:1383

Fixed in:rhel9-operator@sha256:93ed7e87e7660991843f3b2114ff2abe74f3b509c2b9a0ee32fc8707051203af_amd64RHSA-2024:1383

Fixed in:core-rhel9@sha256:23becbe8a9d70cda09e2d10fdd3411b943368a3d92535798d595d29b5bbc4f7e_arm64RHSA-2024:1383

Fixed in:rhel9-operator@sha256:d312e5adf2261eeab1106a72565652637d42e2d49d2294cb1413be62697f18d2_s390xRHSA-2024:1383

odf4/mcgRocky