OESA-2026-4709: rpm security update
The RPM Package Manager (RPM) is a powerful package management system capability as below Security Fix(es):
A heap-based buffer overflow flaw was found in rpm. RPMTAGFILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.(CVE-2026-103242)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/rpmto a version that resolves this vulnerability.Fixed in 4.18.2-43.oe2403sp1
Event History
Frequently Asked Questions
Which RPM commands can reach the vulnerable parsing path?
The flaw is reachable when processing an untrusted package with rpm2cpio, rpm2archive, or rpm -qlvp.
Does a package need to be installed to trigger the issue?
No. The affected paths include package conversion and query operations on an untrusted package, so processing the package can reach the flaw without installing it.
What must an attacker-controlled package contain?
The package must be a crafted, unsigned RPM whose main header has an RPMTAG_FILESIGNATURES tag declared with the wrong header type. Its hex-decoded content can then be written past a one-byte allocation.