CVE-2017-7501

    Dashboard / Vulnerabilities / CVE-2017-7501

    CVE-2017-7501

    Published: 22 Nov 2017Last Modified: 8 Jul 2026

    Summary:

    Details: It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

    References: https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E, https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E, https://security.gentoo.org/glsa/201811-22, https://github.com/rpm-software-management/rpm/commit/404ef011c300207cdb1e531670384564aae04bdc

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c14fa5e05801481d9b4bbc8bedc6a02527713f12

    Affected versions

    rpm-4.13.0.1-release
    rpm-4.13.0-release
    rpm-4.13.0-rc2
    rpm-4.13.0-rc1
    rpm-4.13.0-alpha

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High