{"id":"CVE-2021-44038","aliases":["AZL-36984","AZL-7336","CLSA-2022-1643112395","CLSA-2022-1643113123","CLSA-2024-1734007022","CLSA-2025-1762800667","EUVD-2021-30897","GHSA-h99v-fr29-7p28","UBUNTU-CVE-2021-44038","openSUSE-SU-2024:12504-1"],"status":"published","title":"An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested...","description":"An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00786,"percentile":0.56571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269","CWE-59"],"published":"2021-11-19T18:29:55Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"TuxCare:CentOS:6","package":"quagga","fixed_in":["0.99.15-14.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"quagga-contrib","fixed_in":["0.99.15-14.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"quagga-devel","fixed_in":["0.99.15-14.el6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"quagga","fixed_in":["0.99.15-14.0.2.el6.tuxcare.ol.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"quagga-contrib","fixed_in":["0.99.15-14.0.2.el6.tuxcare.ol.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"quagga-devel","fixed_in":["0.99.15-14.0.2.el6.tuxcare.ol.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga","fixed_in":["1.2.4-1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-bgpd","fixed_in":["1.2.4-1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-core","fixed_in":["1.2.4-1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-doc","fixed_in":["1.2.4-1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-isisd","fixed_in":["1.2.4-1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-ospf6d","fixed_in":["1.2.4-1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-ospfd","fixed_in":["1.2.4-1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-pimd","fixed_in":["1.2.4-1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-ripd","fixed_in":["1.2.4-1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-ripngd","fixed_in":["1.2.4-1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"quagga","fixed_in":["1.2.4-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"quagga-bgpd","fixed_in":["1.2.4-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"quagga-core","fixed_in":["1.2.4-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"quagga-doc","fixed_in":["1.2.4-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"quagga-isisd","fixed_in":["1.2.4-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"quagga-ospf6d","fixed_in":["1.2.4-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"quagga-ospfd","fixed_in":["1.2.4-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"quagga-pimd","fixed_in":["1.2.4-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"quagga-ripd","fixed_in":["1.2.4-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"quagga-ripngd","fixed_in":["1.2.4-3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"quagga","fixed_in":["1.2.4-5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.4-16"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.4-15"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-14.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"quagga-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-14.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"quagga-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-14.el6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-14.0.2.el6.tuxcare.ol.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"quagga-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-14.0.2.el6.tuxcare.ol.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"quagga-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-14.0.2.el6.tuxcare.ol.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-bgpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-isisd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-ospf6d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-ospfd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-pimd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-ripd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"quagga-ripngd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"quagga-bgpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"quagga-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"quagga-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"quagga-isisd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"quagga-ospf6d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"quagga-ospfd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"quagga-pimd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"quagga-ripd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"quagga-ripngd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.99.24.1-2","0.99.24.1-2ubuntu1","0.99.24.1-2ubuntu1.1","0.99.24.1-2ubuntu1.2","0.99.24.1-2ubuntu1.3","0.99.24.1-2ubuntu1.4","0.99.24.1-2ubuntu1.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1-3","1.1.1-3ubuntu1","1.2.2-1","1.2.2-1ubuntu1","1.2.4-1","1.2.4-1ubuntu0.1~esm1","1.2.4-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.4-4build1","1.2.4-4ubuntu0.1","1.2.4-4ubuntu0.4","1.2.4-4ubuntu0.5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-5.1"}]}]}],"products":[{"vendor":"quagga","product":"quagga"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1191890","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/Quagga/quagga/releases","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44038","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h99v-fr29-7p28"},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1643112395.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1643113123.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1734007022.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1762800667.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-44038","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44038","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44038","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-44038","description":"An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.","status":"published","published":"2021-11-19T18:29:55Z","modified":"2024-08-04T04:10:17.181Z","updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2021-30897","description":"An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.","status":"published","published":"2021-11-19T18:29:55Z","modified":"2024-08-04T04:10:17Z","updated_at":"2026-11-03T03:24:12.599691Z"}],"ghsa":[{"id":"GHSA-h99v-fr29-7p28","title":"An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested...","description":"An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.","status":"published","published":"2021-11-20T00:00:49Z","modified":"2023-01-27T05:01:14Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:41:50.629165Z"}],"nvd":[{"id":"CVE-2021-44038","description":"An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.","status":"published","published":"2021-11-19T19:15:09.287Z","modified":"2026-06-17T04:11:50.04Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:07:01.428028Z"}],"osv":[{"id":"AZL-36984","title":"CVE-2021-44038 affecting package quagga 1.2.4-16","description":"An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.","status":"published","published":"2021-11-19T19:15:09Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-7336","title":"CVE-2021-44038 affecting package quagga 1.2.4-15","description":"An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.","status":"published","published":"2021-11-19T19:15:09Z","modified":"2026-04-21T04:33:52.249485Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2021-44038","description":"An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.","status":"published","published":"2021-11-19T19:15:09.287Z","modified":"2026-10-20T10:55:04.935631396Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"UBUNTU-CVE-2021-44038","description":"An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.","status":"published","published":"2021-11-19T19:15:00Z","modified":"2025-10-24T04:50:37Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"CLSA-2022-1643112395","title":"Fix of CVE: CVE-2021-44038","description":"- CVE-2021-44038: low privilege escalation during package installation/update due to \n  insecure chmod in spec file.","status":"published","published":"2022-01-25T12:06:35Z","modified":"2026-06-01T00:33:15.403409458Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1643113123","title":"Fixed CVE-2021-44038 in quagga","description":"- CVE-2021-44038: low privilege escalation during package installation/update due to\n  insecure chmod in spec file.","status":"published","published":"2022-01-25T12:18:43Z","modified":"2026-06-01T00:33:24.387569522Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2024-1734007022","title":"Fix CVE(s): CVE-2021-44038","description":"   * SECURITY UPDATE: Unsafe chown/chmod operations in .service files\n     - debian/patches/CVE-2021-44038.patch: remove chown/chmod commands\n       from the .service files\n     - CVE-2021-44038","status":"published","published":"2024-12-12T12:37:07Z","modified":"2026-06-04T10:04:10.590066Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1762800667","title":"Fix CVE(s): CVE-2021-44038","description":"   * SECURITY UPDATE: Unsafe chown/chmod operations in .service files\n     - debian/patches/CVE-2021-44038.patch: remove chown/chmod commands\n       from the .service files\n     - CVE-2021-44038","status":"published","published":"2025-11-10T18:51:12Z","modified":"2026-06-04T10:03:46.329486Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"openSUSE-SU-2024:12504-1","title":"libfpm_pb0-1.2.4-5.1 on GA media","description":"These are all security issues fixed in the libfpm_pb0-1.2.4-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:29:12.709613Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}