RHSA-2026:99595MediumCVSS 7.8

Red Hat Security Advisory: rpm security update

Published
November 12, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (4)

CVE-2026-78367 →CVE-2026-84233 →CVE-2026-84837 →CVE-2026-84838 →

📋 Description

CVE-2026-78367 — rpm: rpmbuild getTarSpec() crafted tar member name → macro injection CVE-2026-84233 — rpm: Command Execution via Macro Expansion in rpmuncompress -x for Crafted .gem Filenames CVE-2026-84837 — rpm: Command Injection in rpmbuild -t* (getTarSpec) via Unescaped Tarball Path CVE-2026-84838 — rpm: Command injection in rpmuncompress via unescaped filenames passed to popen()

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-rpm-0:4.19.1.1-29.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-rpm-0:4.19.1.1-29.el10_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-rpm-0:4.19.1.1-29.el10_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-rpm-0:4.19.1.1-29.el10_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-rpm-debuginfo-0:4.19.1.1-29.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-rpm-debuginfo-0:4.19.1.1-29.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-rpm-debuginfo-0:4.19.1.1-29.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-rpm-debuginfo-0:4.19.1.1-29.el10_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-rpm-debuginfo-0:4.19.1.1-29.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-rpm-debuginfo-0:4.19.1.1-29.el10_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • python3-rpm-debuginfo-0:4.19.1.1-29.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-rpm-debuginfo-0:4.19.1.1-29.el10_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • rpm-0:4.19.1.1-29.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • rpm-0:4.19.1.1-29.el10_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • rpm-0:4.19.1.1-29.el10_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • rpm-0:4.19.1.1-29.el10_3.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • rpm-0:4.19.1.1-29.el10_3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • rpm-apidocs-0:4.19.1.1-29.el10_3.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • rpm-build-0:4.19.1.1-29.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • rpm-build-0:4.19.1.1-29.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • rpm-build-0:4.19.1.1-29.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • rpm-build-0:4.19.1.1-29.el10_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • rpm-build-debuginfo-0:4.19.1.1-29.el10_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • rpm-build-debuginfo-0:4.19.1.1-29.el10_3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • rpm-build-debuginfo-0:4.19.1.1-29.el10_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • rpm-build-debuginfo-0:4.19.1.1-29.el10_3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • rpm-build-debuginfo-0:4.19.1.1-29.el10_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • rpm-build-debuginfo-0:4.19.1.1-29.el10_3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Do not process untrusted tarballs with rpmbuild -ta/-tb/-ts. Extract and inspect archives first (reject member names containing }, %, or {), or build from a reviewed .spec outside tarball mode. Prefer isolated builders (mock/container) for any untrusted packaging related work. Workaround: To mitigate this vulnerability, avoid using `rpmuncompress -x` (or a build workflow that invokes it via %{__rpmuncompress}) on `.gem` files from untrusted sources. Before extraction, rename `.gem` files to remove any RPM macro syntax (e.g., `%(...)`) or utilize an alternative extraction tool that does not expand RPM macros in filenames. In automated environments, implement validation to reject or sanitize untrusted archive names prior to processing Workaround: To mitigate this issue, avoid using `rpmbuild -t*` with tarballs whose paths or filenames can be influenced by untrusted input. In automated build pipelines, ensure tarballs are staged into a trusted local directory and their names are normalized or validated to reject shell metacharacters before `rpmbuild` is invoked. Workaround: To mitigate this issue, avoid processing untrusted archive filenames with `rpmuncompress` or any workflows that invoke `%{__rpmuncompress}`. Before any build or extraction steps, rename source and patch archives to remove any shell metacharacters from their filenames.

🔗 References (7)