Every CVE Search/ Get API key

CVE-2021-44038

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested...

7.8 HighFix available

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.79%Up 0.2 points since Nov 20, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

Record
CVE-2021-44038
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-59
Updated
2026-11-02
CVE List No score

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

Record
CVE-2021-44038
Updated
2026-11-02
EUVDEUVD-2021-30897 No score

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

Record
EUVD-2021-30897
Updated
2026-11-03
GitHub AdvisoriesGHSA-h99v-fr29-7p28 7.8

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested...

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

Record
GHSA-h99v-fr29-7p28
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-02
OSVAZL-36984 7.8

CVE-2021-44038 affecting package quagga 1.2.4-16

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

Record
AZL-36984
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSVAZL-7336 7.8

CVE-2021-44038 affecting package quagga 1.2.4-15

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

Record
AZL-7336
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSV 7.8

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

Record
CVE-2021-44038
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-44038 7.8

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

Record
UBUNTU-CVE-2021-44038
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2022-1643112395 No score

Fix of CVE: CVE-2021-44038

  • CVE-2021-44038: low privilege escalation during package installation/update due to insecure chmod in spec file.
Record
CLSA-2022-1643112395
Updated
2026-11-02
OSVCLSA-2022-1643113123 No score

Fixed CVE-2021-44038 in quagga

  • CVE-2021-44038: low privilege escalation during package installation/update due to insecure chmod in spec file.
Record
CLSA-2022-1643113123
Updated
2026-11-02
OSVCLSA-2024-1734007022 No score

Fix CVE(s): CVE-2021-44038

  • SECURITY UPDATE: Unsafe chown/chmod operations in .service files
    • debian/patches/CVE-2021-44038.patch: remove chown/chmod commands from the .service files
    • CVE-2021-44038
Record
CLSA-2024-1734007022
Updated
2026-11-02
OSVCLSA-2025-1762800667 No score

Fix CVE(s): CVE-2021-44038

  • SECURITY UPDATE: Unsafe chown/chmod operations in .service files
    • debian/patches/CVE-2021-44038.patch: remove chown/chmod commands from the .service files
    • CVE-2021-44038
Record
CLSA-2025-1762800667
Updated
2026-11-02
OSVopenSUSE-SU-2024:12504-1 No score

libfpm_pb0-1.2.4-5.1 on GA media

These are all security issues fixed in the libfpm_pb0-1.2.4-5.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12504-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
quagga
Azure Linux:3
 through 1.2.4-16 None known
quagga
Azure Linux:2
 through 1.2.4-15 None known
quagga
TuxCare:CentOS:6
 before 0.99.15-14.el6.tuxcare.els1
0.99.15-14.el6.tuxcare.els1
quagga-contrib
TuxCare:CentOS:6
 before 0.99.15-14.el6.tuxcare.els1
0.99.15-14.el6.tuxcare.els1
quagga-devel
TuxCare:CentOS:6
 before 0.99.15-14.el6.tuxcare.els1
0.99.15-14.el6.tuxcare.els1
quagga
TuxCare:OracleLinux:6
 before 0.99.15-14.0.2.el6.tuxcare.ol.els1
0.99.15-14.0.2.el6.tuxcare.ol.els1
quagga-contrib
TuxCare:OracleLinux:6
 before 0.99.15-14.0.2.el6.tuxcare.ol.els1
0.99.15-14.0.2.el6.tuxcare.ol.els1
quagga-devel
TuxCare:OracleLinux:6
 before 0.99.15-14.0.2.el6.tuxcare.ol.els1
0.99.15-14.0.2.el6.tuxcare.ol.els1
quagga
TuxCare:Ubuntu:18.04
 before 1.2.4-1+tuxcare.els2
1.2.4-1+tuxcare.els2
quagga-bgpd
TuxCare:Ubuntu:18.04
 before 1.2.4-1+tuxcare.els2
1.2.4-1+tuxcare.els2
Show 22 moreShow less
Affected packages
PackageAffectedFixed
quagga-core
TuxCare:Ubuntu:18.04
 before 1.2.4-1+tuxcare.els2
1.2.4-1+tuxcare.els2
quagga-doc
TuxCare:Ubuntu:18.04
 before 1.2.4-1+tuxcare.els2
1.2.4-1+tuxcare.els2
quagga-isisd
TuxCare:Ubuntu:18.04
 before 1.2.4-1+tuxcare.els2
1.2.4-1+tuxcare.els2
quagga-ospf6d
TuxCare:Ubuntu:18.04
 before 1.2.4-1+tuxcare.els2
1.2.4-1+tuxcare.els2
quagga-ospfd
TuxCare:Ubuntu:18.04
 before 1.2.4-1+tuxcare.els2
1.2.4-1+tuxcare.els2
quagga-pimd
TuxCare:Ubuntu:18.04
 before 1.2.4-1+tuxcare.els2
1.2.4-1+tuxcare.els2
quagga-ripd
TuxCare:Ubuntu:18.04
 before 1.2.4-1+tuxcare.els2
1.2.4-1+tuxcare.els2
quagga-ripngd
TuxCare:Ubuntu:18.04
 before 1.2.4-1+tuxcare.els2
1.2.4-1+tuxcare.els2
quagga
TuxCare:Debian:10
 before 1.2.4-3+tuxcare.els1
1.2.4-3+tuxcare.els1
quagga-bgpd
TuxCare:Debian:10
 before 1.2.4-3+tuxcare.els1
1.2.4-3+tuxcare.els1
quagga-core
TuxCare:Debian:10
 before 1.2.4-3+tuxcare.els1
1.2.4-3+tuxcare.els1
quagga-doc
TuxCare:Debian:10
 before 1.2.4-3+tuxcare.els1
1.2.4-3+tuxcare.els1
quagga-isisd
TuxCare:Debian:10
 before 1.2.4-3+tuxcare.els1
1.2.4-3+tuxcare.els1
quagga-ospf6d
TuxCare:Debian:10
 before 1.2.4-3+tuxcare.els1
1.2.4-3+tuxcare.els1
quagga-ospfd
TuxCare:Debian:10
 before 1.2.4-3+tuxcare.els1
1.2.4-3+tuxcare.els1
quagga-pimd
TuxCare:Debian:10
 before 1.2.4-3+tuxcare.els1
1.2.4-3+tuxcare.els1
quagga-ripd
TuxCare:Debian:10
 before 1.2.4-3+tuxcare.els1
1.2.4-3+tuxcare.els1
quagga-ripngd
TuxCare:Debian:10
 before 1.2.4-3+tuxcare.els1
1.2.4-3+tuxcare.els1
quagga
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.99.24.1-20.99.24.1-2ubuntu10.99.24.1-2ubuntu1.10.99.24.1-2ubuntu1.20.99.24.1-2ubuntu1.30.99.24.1-2ubuntu1.40.99.24.1-2ubuntu1.4+esm1
 None known
quagga
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.1.1-31.1.1-3ubuntu11.2.2-11.2.2-1ubuntu11.2.4-11.2.4-1ubuntu0.1~esm11.2.4-1ubuntu0.1~esm2
 None known
quagga
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.2.4-4build11.2.4-4ubuntu0.11.2.4-4ubuntu0.41.2.4-4ubuntu0.5
 None known
quagga
openSUSE:Tumbleweed
 before 1.2.4-5.1
1.2.4-5.1

History

History
RecordedChangedSources
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-44038 is a high vulnerability (CVSS 7.8) in Quagga, published November 19, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. Fixed in quagga 0.99.15-14.el6.tuxcare.els1.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open