OESA-2026-4710: rpm security update
The RPM Package Manager (RPM) is a powerful package management system capability as below Security Fix(es):
A heap-based buffer overflow flaw was found in rpm. RPMTAGFILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.(CVE-2026-103242)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/rpmto a version that resolves this vulnerability.Fixed in 4.18.2-43.oe2403sp3
Event History
Frequently Asked Questions
Who is most exposed to this issue?
Systems or users that inspect or extract untrusted RPM packages using rpm2cpio, rpm2archive, or rpm -qlvp are exposed. The vulnerable parsing path is reached when one of those tools processes a crafted unsigned RPM package.
What does an attacker need to exploit the flaw?
An attacker needs to provide a crafted unsigned RPM whose main header contains a malformed RPMTAG_FILESIGNATURES entry. A user must then process that package through one of the affected commands.
What can be done before an update is applied?
Do not run rpm2cpio, rpm2archive, or rpm -qlvp against RPM packages from untrusted sources. Restrict package inspection and extraction to RPMs obtained through trusted channels.