Описание
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.
Отчет
This issue is considered Moderate severity because, although successful exploitation allows arbitrary command execution with the privileges of the user running rpmuncompress (or a build workflow that invokes it via %{__rpmuncompress}), exploitation requires a specially crafted local archive filename to be processed by that tool. The vulnerable code is not exposed as a network service and cannot be triggered remotely without a user or automated workflow invoking rpmuncompress on the attacker-controlled filename.
Меры по смягчению последствий
To mitigate this issue, avoid processing untrusted archive filenames with rpmuncompress or any workflows that invoke %{__rpmuncompress}. Before any build or extraction steps, rename source and patch archives to remove any shell metacharacters from their filenames.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | rpm | Affected | ||
| Red Hat Enterprise Linux 6 | rpm | Not affected | ||
| Red Hat Enterprise Linux 7 | rpm | Not affected | ||
| Red Hat Enterprise Linux 8 | rpm | Not affected | ||
| Red Hat Enterprise Linux 9 | rpm | Not affected | ||
| Red Hat Hardened Images | rpm | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.
Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()
A flaw was found in rpmuncompress. This command injection vulnerabilit ...
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.
EPSS
7.8 High
CVSS3