Amazon Linux 2023 Security Advisory: ALAS2023-2026-1991
Advisory Released Date: 2026-08-04
Advisory Updated Date: 2026-08-04
Severity:
Important
Issue Overview:
A heap buffer overflow exists in RPM's NDB database backend (lib/backend/ndb/rpmpkg.c) due to unchecked 32-bit arithmetic when parsing the slot table. The slotnpages value is read directly from the on-disk NDB header and used in a 32-bit multiplication (slotnpages * (PAGE_SIZE / SLOT_SIZE)) to size a heap allocation. A crafted Packages.db can supply a slotnpages value that wraps this product to a small number, causing xcalloc to allocate an undersized buffer. The subsequent loop iterates over the full unwrapped page count, writing pkgslot entries past the heap boundary before per-slot validation runs. Exploitation requires the victim to open a crafted NDB database file with RPM tooling, and NDB is not the default backend in Fedora or RHEL (both default to sqlite). (CVE-2026-44605)
Affected Packages:
rpm
Issue Correction:
Run dnf update rpm --releasever 2023.12.20260803 or dnf update --advisory ALAS2023-2026-1991 --releasever 2023.12.20260803 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
rpm-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-syslog-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-devel-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-systemd-inhibit-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-fapolicyd-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-ima-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-selinux-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-sign-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-libs-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-sign-libs-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-sign-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-build-libs-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-syslog-4.16.1.3-29.amzn2023.0.7.aarch64
python3-rpm-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-build-libs-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-ima-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-build-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-debugsource-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-prioreset-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-build-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-devel-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-sign-libs-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-selinux-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-audit-4.16.1.3-29.amzn2023.0.7.aarch64
python3-rpm-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-libs-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-audit-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-fapolicyd-debuginfo-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-prioreset-4.16.1.3-29.amzn2023.0.7.aarch64
rpm-plugin-systemd-inhibit-4.16.1.3-29.amzn2023.0.7.aarch64
noarch:
rpm-apidocs-4.16.1.3-29.amzn2023.0.7.noarch
rpm-cron-4.16.1.3-29.amzn2023.0.7.noarch
src:
rpm-4.16.1.3-29.amzn2023.0.7.src
x86_64:
rpm-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-build-libs-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-devel-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-sign-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-prioreset-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-sign-libs-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-debugsource-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-selinux-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-fapolicyd-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-ima-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-ima-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
python3-rpm-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-libs-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-build-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-audit-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-sign-libs-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-audit-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-syslog-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-sign-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-systemd-inhibit-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-selinux-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-build-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-build-libs-4.16.1.3-29.amzn2023.0.7.x86_64
python3-rpm-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-systemd-inhibit-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-fapolicyd-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-syslog-debuginfo-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-plugin-prioreset-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-libs-4.16.1.3-29.amzn2023.0.7.x86_64
rpm-devel-4.16.1.3-29.amzn2023.0.7.x86_64