Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-95521: A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python2-rpm | 0:4.11.3-48.amzn2.0.8 |
| Amazon Linux · 2 | python3-rpm | 0:4.11.3-48.amzn2.0.8 |
| Amazon Linux · 2 | rpm | 0:4.11.3-48.amzn2.0.8 |
| Amazon Linux · 2 | rpm-apidocs | 0:4.11.3-48.amzn2.0.8 |
| Amazon Linux · 2 | rpm-build | 0:4.11.3-48.amzn2.0.8 |
| Amazon Linux · 2 | rpm-build-libs | 0:4.11.3-48.amzn2.0.8 |
| Amazon Linux · 2 | rpm-cron | 0:4.11.3-48.amzn2.0.8 |
| Amazon Linux · 2 | rpm-debuginfo | 0:4.11.3-48.amzn2.0.8 |
| Amazon Linux · 2 | rpm-devel | 0:4.11.3-48.amzn2.0.8 |
| Amazon Linux · 2 | rpm-libs | 0:4.11.3-48.amzn2.0.8 |
| Amazon Linux · 2 | rpm-plugin-systemd-inhibit | 0:4.11.3-48.amzn2.0.8 |
| Amazon Linux · 2 | rpm-sign | 0:4.11.3-48.amzn2.0.8 |
Vulnerabilities 1
-
High 7.8
Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. Th…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-95521.html