CVE-2026-84233: Red Hat Hardened Images, инжекция

Описание

Оригинално описание

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Засегнати продукти

• Red Hat Red Hat Hardened Images: 6.1.0-1.hum1 преди *
• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 6
• Red Hat Red Hat Enterprise Linux 7
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 9

Вид слабост

• CWE-78 Инжектиране на команди към операционната система

История

Други уязвимости в Red Hat Red Hat Hardened Images

• 6.5CVE-2026-121259
• 6.5CVE-2026-119843
• 6.5CVE-2026-120831
• 7.4CVE-2026-120830
• 2.0CVE-2026-120740

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-84233
• https://nvd.nist.gov/vuln/detail/CVE-2026-84233
• https://access.redhat.com/errata/RHSA-2026:66637
• https://access.redhat.com/security/cve/CVE-2026-84233
• https://bugzilla.redhat.com/show_bug.cgi?id=2478409