A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade rpm-debugsourceUpgrade rpm-plugin-selinux-debuginfoUpgrade rpm-build-debuginfoUpgrade rpm-plugin-fapolicyd-debuginfoUpgrade rpm-apidocsUpgrade rpm-plugin-selinuxUpgrade rpm-plugin-prioreset-debuginfoUpgrade rpm-build-libs-debuginfoUpgrade rpm-sign-libsUpgrade rpm-buildUpgrade rpm-plugin-fapolicydUpgrade rpm-libsUpgrade rpm-cronUpgrade rpm-develUpgrade rpm-sign-libs-debuginfoUpgrade rpm-plugin-auditUpgrade rpm-sign-debuginfoUpgrade rpm-libs-debuginfoUpgrade rpm-plugin-prioresetUpgrade rpm-plugin-systemd-inhibitUpgrade rpm-devel-debuginfoUpgrade python3-rpm-debuginfoUpgrade rpm-debuginfoUpgrade rpmUpgrade rpm-plugin-systemd-inhibit-debuginfoUpgrade rpm-build-libsUpgrade rpm-plugin-imaUpgrade python3-rpmUpgrade rpm-plugin-syslogUpgrade rpm-plugin-syslog-debuginfoUpgrade rpm-plugin-ima-debuginfoUpgrade rpm-plugin-audit-debuginfoUpgrade rpm-sign | Sep 30, 2026 | Sep 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub