CVE-2017-7501: red hat, inc. rpm Link Following

Vulnerability summary

CVE-2017-7501 is a high (CVSS 7.8) Link Following vulnerability in red hat, inc. rpm. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.8% of scored vulnerabilities.

Timeline

1. 22-11-2017
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.