RLSA-2026:98644: Important: gstreamer1-plugins-good security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.
Security Fix(es):
gst-plugins-good: gst-plugins-good: Local file disclosure via unvalidated file:// URIs in adaptivedemux2 manifest handling (CVE-2026-121629)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-good-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.26.7-10.el10_3.1 - Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-good-gtk-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.7-10.el10_3.1 - Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-good-gtkto a version that resolves this vulnerability.Fixed in 0:1.26.7-10.el10_3.1 - Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-good-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.26.7-10.el10_3.1 - Upgrade
Upgrade
rocky-linux/gstreamer1-plugins-goodto a version that resolves this vulnerability.Fixed in 0:1.26.7-10.el10_3.1
Event History
Frequently Asked Questions
What capability does an attacker need to exploit this issue?
The issue is rated network-accessible with low attack complexity, requires no privileges, and requires no user interaction. The provided information identifies the vulnerable path as adaptivedemux2 manifest handling of unvalidated file:// URIs.
What is the expected impact if exploitation succeeds?
The reported impact is local file disclosure, with high confidentiality impact. No integrity or availability impact is indicated by the supplied CVSS vector.
Which Rocky Linux packages are covered by this update?
The update covers gstreamer1-plugins-good, gstreamer1-plugins-good-debugsource, gstreamer1-plugins-good-debuginfo, gstreamer1-plugins-good-gtk, and gstreamer1-plugins-good-gtk-debuginfo.