OESA-2026-4708: rpm security update
The RPM Package Manager (RPM) is a powerful package management system capability as below Security Fix(es):
A heap-based buffer overflow flaw was found in rpm. RPMTAGFILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.(CVE-2026-103242)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/rpmto a version that resolves this vulnerability.Fixed in 4.17.0-54.oe2203sp4
Event History
Frequently Asked Questions
Which RPM operations can reach the vulnerable code path?
The issue is reachable when processing an untrusted package with rpm2cpio, rpm2archive, or rpm -qlvp.
What must an attacker provide to trigger the flaw?
An attacker needs a crafted, unsigned RPM package whose main header contains an RPMTAG_FILESIGNATURES tag declared with the wrong header type. The victim must process that package using an affected command.
Is elevated privilege required to exploit this issue?
The supplied CVSS vector indicates no privileges are required by the attacker, but user interaction is required. The stated impact includes high integrity and availability impact.