Source: rpm
Version: 6.1.0-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/rpm-software-management/rpm/issues/4314
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for rpm.
CVE-2026-78367[0]:
| A vulnerability was found in RPM's rpmbuild tarball processing. When
| processing a crafted source archive, the getTarSpec() function in
| tools/rpmbuild.cc passes an attacker-controlled tar archive member
| name to rpmExpand() as part of a %{basename:...} macro expression. A
| specially crafted .spec member name can therefore inject RPM macros,
| including Lua expressions, resulting in arbitrary code execution
| with the privileges of the user running rpmbuild. This can be
| exploited when a victim or automated build system processes an
| attacker-controlled source tarball using rpmbuild tarball mode (such
| as -ts, -ta, or -tb).
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-78367
https://www.cve.org/CVERecord?id=CVE-2026-78367
[1] https://github.com/rpm-software-management/rpm/issues/4314
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
