RHSA-2026:66637MediumCVSS 7.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
September 11, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-84233 →

📋 Description

CVE-2026-84233 — rpm: Command Execution via Macro Expansion in rpmuncompress -x for Crafted .gem Filenames

🎯 Affected products42

  • Red Hat Hardened Images
  • python3-rpm-0:6.1.0-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3-rpm-0:6.1.0-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-0:6.1.0-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-0:6.1.0-1.hum1@src as a component of Red Hat Hardened Images
  • rpm-0:6.1.0-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-apidocs-0:6.1.0-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • rpm-apidocs-0:6.1.0-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • rpm-build-0:6.1.0-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-build-0:6.1.0-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-build-libs-0:6.1.0-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-build-libs-0:6.1.0-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-cron-0:6.1.0-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • rpm-cron-0:6.1.0-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • rpm-devel-0:6.1.0-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-devel-0:6.1.0-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-libs-0:6.1.0-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-libs-0:6.1.0-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-plugin-audit-0:6.1.0-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-plugin-audit-0:6.1.0-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-plugin-dbus-announce-0:6.1.0-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-plugin-dbus-announce-0:6.1.0-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-plugin-fapolicyd-0:6.1.0-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-plugin-fapolicyd-0:6.1.0-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-plugin-fsverity-0:6.1.0-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-plugin-fsverity-0:6.1.0-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-plugin-ima-0:6.1.0-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-plugin-ima-0:6.1.0-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-plugin-prioreset-0:6.1.0-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-plugin-prioreset-0:6.1.0-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • +12 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this vulnerability, avoid using `rpmuncompress -x` (or a build workflow that invokes it via %{__rpmuncompress}) on `.gem` files from untrusted sources. Before extraction, rename `.gem` files to remove any RPM macro syntax (e.g., `%(...)`) or utilize an alternative extraction tool that does not expand RPM macros in filenames. In automated environments, implement validation to reject or sanitize untrusted archive names prior to processing

🔗 References (5)