Описание
A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
Отчет
This issue is considered Moderate severity because, although successful exploitation allows arbitrary command execution with the privileges of the user or workflow invoking rpmuncompress -x (or a build workflow that invokes it via %{__rpmuncompress}), exploitation requires a specially crafted local .gem filename containing RPM macro syntax to be processed by that tool. The vulnerable code is not exposed as a network service and cannot be triggered remotely without a user or automated workflow invoking rpmuncompress on the attacker-controlled filename.
Меры по смягчению последствий
To mitigate this vulnerability, avoid using rpmuncompress -x (or a build workflow that invokes it via %{__rpmuncompress}) on .gem files from untrusted sources. Before extraction, rename .gem files to remove any RPM macro syntax (e.g., %(...)) or utilize an alternative extraction tool that does not expand RPM macros in filenames. In automated environments, implement validation to reject or sanitize untrusted archive names prior to processing
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | rpm | Affected | ||
| Red Hat Enterprise Linux 6 | rpm | Not affected | ||
| Red Hat Enterprise Linux 7 | rpm | Not affected | ||
| Red Hat Enterprise Linux 8 | rpm | Not affected | ||
| Red Hat Enterprise Linux 9 | rpm | Not affected | ||
| Red Hat Hardened Images | rpm | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
Связанные уязвимости
(A flaw was found in rpm. A local attacker could supply a specially cra ...)
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames
A flaw was found in rpm. A local attacker could supply a specially cra ...
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
EPSS
7 High
CVSS3