ALAS2023-2026-3125

References: CVE-2026-78367  CVE-2026-84233 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball. (CVE-2026-78367)

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability. (CVE-2026-84233)

Issue Correction:
Run dnf update rpm --releasever 2023.12.20260928 or dnf update --advisory ALAS2023-2026-3125 --releasever 2023.12.20260928 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    rpm-plugin-systemd-inhibit-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-sign-libs-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-ima-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-fapolicyd-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-syslog-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-libs-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-build-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-selinux-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-sign-libs-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-ima-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-fapolicyd-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-libs-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-prioreset-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-build-libs-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    python3-rpm-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-sign-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    python3-rpm-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-audit-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-syslog-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-devel-debuginfo-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-build-libs-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-selinux-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-audit-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-debugsource-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-sign-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-devel-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-prioreset-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-build-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-plugin-systemd-inhibit-4.16.1.3-29.amzn2023.0.8.aarch64
    rpm-4.16.1.3-29.amzn2023.0.8.aarch64

noarch:
    rpm-apidocs-4.16.1.3-29.amzn2023.0.8.noarch
    rpm-cron-4.16.1.3-29.amzn2023.0.8.noarch

src:
    rpm-4.16.1.3-29.amzn2023.0.8.src

x86_64:
    rpm-build-libs-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-sign-libs-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-ima-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-fapolicyd-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-build-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-sign-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-devel-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-audit-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-libs-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-systemd-inhibit-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-build-libs-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-syslog-4.16.1.3-29.amzn2023.0.8.x86_64
    python3-rpm-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-prioreset-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-sign-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-devel-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-syslog-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-libs-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-audit-4.16.1.3-29.amzn2023.0.8.x86_64
    python3-rpm-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-systemd-inhibit-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-build-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-debugsource-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-ima-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-selinux-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-selinux-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-prioreset-debuginfo-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-plugin-fapolicyd-4.16.1.3-29.amzn2023.0.8.x86_64
    rpm-sign-libs-4.16.1.3-29.amzn2023.0.8.x86_64