OESA-2026-4803: rpm security update
The RPM Package Manager (RPM) is a powerful package management system capability as below Security Fix(es):
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the rpm process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.(CVE-2026-95519)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/rpmto a version that resolves this vulnerability.Fixed in 4.17.0-55.oe2203sp4