RHSA-2026:82378MediumCVSS 7.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 13, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (3)

CVE-2026-78367 →CVE-2026-84837 →CVE-2026-84838 →

📋 Description

CVE-2026-78367 — rpm: rpmbuild getTarSpec() crafted tar member name → macro injection CVE-2026-84837 — rpm: Command Injection in rpmbuild -t* (getTarSpec) via Unescaped Tarball Path CVE-2026-84838 — rpm: Command injection in rpmuncompress via unescaped filenames passed to popen()

🎯 Affected products62

  • Red Hat Hardened Images
  • python3-rpm-0:6.1.0-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3-rpm-0:6.1.0-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • python3-rpm-0:6.1.0-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-0:6.1.0-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-0:6.1.0-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • rpm-0:6.1.0-1.3.hum1@src as a component of Red Hat Hardened Images
  • rpm-0:6.1.0-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-apidocs-0:6.1.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • rpm-apidocs-0:6.1.0-1.3.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • rpm-apidocs-0:6.1.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • rpm-build-0:6.1.0-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-build-0:6.1.0-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • rpm-build-0:6.1.0-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-build-libs-0:6.1.0-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-build-libs-0:6.1.0-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • rpm-build-libs-0:6.1.0-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-cron-0:6.1.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • rpm-cron-0:6.1.0-1.3.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • rpm-cron-0:6.1.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • rpm-devel-0:6.1.0-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-devel-0:6.1.0-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • rpm-devel-0:6.1.0-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-libs-0:6.1.0-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-libs-0:6.1.0-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • rpm-libs-0:6.1.0-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-plugin-audit-0:6.1.0-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • rpm-plugin-audit-0:6.1.0-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • rpm-plugin-audit-0:6.1.0-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • rpm-plugin-dbus-announce-0:6.1.0-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • +32 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Do not process untrusted tarballs with rpmbuild -ta/-tb/-ts. Extract and inspect archives first (reject member names containing }, %, or {), or build from a reviewed .spec outside tarball mode. Prefer isolated builders (mock/container) for any untrusted packaging related work. Workaround: To mitigate this issue, avoid using `rpmbuild -t*` with tarballs whose paths or filenames can be influenced by untrusted input. In automated build pipelines, ensure tarballs are staged into a trusted local directory and their names are normalized or validated to reject shell metacharacters before `rpmbuild` is invoked. Workaround: To mitigate this issue, avoid processing untrusted archive filenames with `rpmuncompress` or any workflows that invoke `%{__rpmuncompress}`. Before any build or extraction steps, rename source and patch archives to remove any shell metacharacters from their filenames.

🔗 References (7)