RLSA-2026:99595

Synopsis

Moderate: rpm security update

Description

The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.

Security Fix(es):

* rpm: Command injection in rpmuncompress via unescaped filenames passed to popen() (CVE-2026-84838)

* rpm: Command Injection in `rpmbuild -t*` (`getTarSpec`) via Unescaped Tarball Path (CVE-2026-84837)

* rpm: Command Execution via Macro Expansion in `rpmuncompress -x` for Crafted `.gem` Filenames (CVE-2026-84233)

* rpm: rpmbuild getTarSpec() crafted tar member name ? macro injection (CVE-2026-78367)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Rocky Linux 10 aarch64 Rocky Linux 10 ppc64le Rocky Linux 10 riscv64 Rocky Linux 10 s390x Rocky Linux 10 x86_64

Fixes

2478408 2462222 2521857 2478409

CVEs

CVE-2026-78367 CVE-2026-84233 CVE-2026-84837 CVE-2026-84838

Affected packages

Rocky Linux 10 ppc64le - BaseOS

rpm-sign-libs-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-plugin-selinux-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-libs-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-plugin-selinux-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-plugin-audit-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm python3-rpm-0:4.19.1.1-29.el10_3.ppc64le.rpm python3-rpm-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-sign-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-libs-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-plugin-syslog-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-debugsource-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-sign-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-sign-libs-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-plugin-syslog-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-build-libs-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-build-libs-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-0:4.19.1.1-29.el10_3.src.rpm rpm-plugin-audit-0:4.19.1.1-29.el10_3.ppc64le.rpm

Rocky Linux 10 x86_64 - AppStream

rpm-plugin-fapolicyd-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-devel-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-cron-0:4.19.1.1-29.el10_3.noarch.rpm rpm-plugin-dbus-announce-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-plugin-dbus-announce-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-plugin-ima-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-devel-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-plugin-systemd-inhibit-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-build-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-build-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-apidocs-0:4.19.1.1-29.el10_3.noarch.rpm rpm-plugin-systemd-inhibit-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-plugin-ima-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-plugin-fapolicyd-0:4.19.1.1-29.el10_3.x86_64.rpm

Rocky Linux 10 s390x - BaseOS

rpm-sign-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-debugsource-0:4.19.1.1-29.el10_3.s390x.rpm rpm-libs-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-sign-0:4.19.1.1-29.el10_3.s390x.rpm rpm-sign-libs-0:4.19.1.1-29.el10_3.s390x.rpm rpm-libs-0:4.19.1.1-29.el10_3.s390x.rpm rpm-0:4.19.1.1-29.el10_3.s390x.rpm rpm-sign-libs-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-build-libs-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm python3-rpm-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-syslog-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-selinux-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-syslog-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm python3-rpm-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-audit-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-selinux-0:4.19.1.1-29.el10_3.s390x.rpm rpm-build-libs-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-audit-0:4.19.1.1-29.el10_3.s390x.rpm rpm-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-0:4.19.1.1-29.el10_3.src.rpm

Rocky Linux 10 aarch64 - BaseOS

rpm-plugin-audit-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-sign-libs-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-sign-libs-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-libs-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-plugin-selinux-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-sign-0:4.19.1.1-29.el10_3.aarch64.rpm python3-rpm-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-plugin-audit-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm python3-rpm-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-debugsource-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-build-libs-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-plugin-syslog-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-0:4.19.1.1-29.el10_3.src.rpm rpm-libs-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-plugin-syslog-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-plugin-selinux-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-sign-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-build-libs-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm

Rocky Linux 10 ppc64le - AppStream

rpm-plugin-fapolicyd-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-plugin-ima-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-build-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-plugin-dbus-announce-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-plugin-dbus-announce-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-cron-0:4.19.1.1-29.el10_3.noarch.rpm rpm-build-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-plugin-ima-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-devel-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-devel-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-plugin-systemd-inhibit-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-apidocs-0:4.19.1.1-29.el10_3.noarch.rpm rpm-plugin-fapolicyd-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm rpm-plugin-systemd-inhibit-debuginfo-0:4.19.1.1-29.el10_3.ppc64le.rpm

Rocky Linux 10 x86_64 - BaseOS

rpm-build-libs-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-sign-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-plugin-selinux-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-build-libs-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-debugsource-0:4.19.1.1-29.el10_3.x86_64.rpm python3-rpm-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-plugin-audit-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-libs-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-sign-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-sign-libs-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-plugin-audit-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-plugin-selinux-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-libs-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-plugin-syslog-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-sign-libs-debuginfo-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-0:4.19.1.1-29.el10_3.x86_64.rpm python3-rpm-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-plugin-syslog-0:4.19.1.1-29.el10_3.x86_64.rpm rpm-0:4.19.1.1-29.el10_3.src.rpm

Rocky Linux 10 aarch64 - AppStream

rpm-build-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-plugin-dbus-announce-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-plugin-fapolicyd-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-devel-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-plugin-fapolicyd-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-cron-0:4.19.1.1-29.el10_3.noarch.rpm rpm-plugin-systemd-inhibit-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-devel-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-build-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-plugin-dbus-announce-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-plugin-ima-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-plugin-systemd-inhibit-0:4.19.1.1-29.el10_3.aarch64.rpm rpm-apidocs-0:4.19.1.1-29.el10_3.noarch.rpm rpm-plugin-ima-debuginfo-0:4.19.1.1-29.el10_3.aarch64.rpm

Rocky Linux 10 s390x - AppStream

rpm-devel-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-ima-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-dbus-announce-0:4.19.1.1-29.el10_3.s390x.rpm rpm-build-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-cron-0:4.19.1.1-29.el10_3.noarch.rpm rpm-build-0:4.19.1.1-29.el10_3.s390x.rpm rpm-devel-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-fapolicyd-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-dbus-announce-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-systemd-inhibit-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-ima-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-plugin-systemd-inhibit-debuginfo-0:4.19.1.1-29.el10_3.s390x.rpm rpm-apidocs-0:4.19.1.1-29.el10_3.noarch.rpm rpm-plugin-fapolicyd-0:4.19.1.1-29.el10_3.s390x.rpm

Rocky Linux 10 riscv64 - AppStream

rpm-cron-0:4.19.1.1-29.el10_3.noarch.rpm rpm-apidocs-0:4.19.1.1-29.el10_3.noarch.rpm

Rocky Linux 10 riscv64 - BaseOS

rpm-0:4.19.1.1-29.el10_3.src.rpm