RHSA-2026:99593MediumCVSS 7.8

Red Hat Security Advisory: rpm security update

Published
November 12, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (2)

CVE-2026-84837 →CVE-2026-78367 →

📋 Description

CVE-2026-78367 — rpm: rpmbuild getTarSpec() crafted tar member name → macro injection CVE-2026-84837 — rpm: Command Injection in rpmbuild -t* (getTarSpec) via Unescaped Tarball Path

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • python3-rpm-0:4.16.1.3-43.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • python3-rpm-0:4.16.1.3-43.el9_9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • python3-rpm-0:4.16.1.3-43.el9_9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • python3-rpm-0:4.16.1.3-43.el9_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • python3-rpm-debuginfo-0:4.16.1.3-43.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3-rpm-debuginfo-0:4.16.1.3-43.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • python3-rpm-debuginfo-0:4.16.1.3-43.el9_9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3-rpm-debuginfo-0:4.16.1.3-43.el9_9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • python3-rpm-debuginfo-0:4.16.1.3-43.el9_9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3-rpm-debuginfo-0:4.16.1.3-43.el9_9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • python3-rpm-debuginfo-0:4.16.1.3-43.el9_9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3-rpm-debuginfo-0:4.16.1.3-43.el9_9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • python3-rpm-debuginfo-0:4.16.1.3-43.el9_9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3-rpm-debuginfo-0:4.16.1.3-43.el9_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpm-0:4.16.1.3-43.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpm-0:4.16.1.3-43.el9_9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpm-0:4.16.1.3-43.el9_9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpm-0:4.16.1.3-43.el9_9.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpm-0:4.16.1.3-43.el9_9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpm-apidocs-0:4.16.1.3-43.el9_9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • rpm-build-0:4.16.1.3-43.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • rpm-build-0:4.16.1.3-43.el9_9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • rpm-build-0:4.16.1.3-43.el9_9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • rpm-build-0:4.16.1.3-43.el9_9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • rpm-build-debuginfo-0:4.16.1.3-43.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • rpm-build-debuginfo-0:4.16.1.3-43.el9_9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpm-build-debuginfo-0:4.16.1.3-43.el9_9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • rpm-build-debuginfo-0:4.16.1.3-43.el9_9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Do not process untrusted tarballs with rpmbuild -ta/-tb/-ts. Extract and inspect archives first (reject member names containing }, %, or {), or build from a reviewed .spec outside tarball mode. Prefer isolated builders (mock/container) for any untrusted packaging related work. Workaround: To mitigate this issue, avoid using `rpmbuild -t*` with tarballs whose paths or filenames can be influenced by untrusted input. In automated build pipelines, ensure tarballs are staged into a trusted local directory and their names are normalized or validated to reject shell metacharacters before `rpmbuild` is invoked.

🔗 References (5)