Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-107
Advisory Release Date: 2026-09-28 09:00 Pacific
Advisory Updated Date: 2026-09-28 09:00 Pacific
Severity:
Important
Issue Overview:
A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball. (CVE-2026-78367)
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability. (CVE-2026-84233)
Affected Packages:
rpm
Issue Correction:
Run yum update rpm to update your system.
New Packages:
aarch64:
rpm-plugin-unshare-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-systemd-inhibit-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-prioreset-6.0.0-1.amzn2027.0.6.aarch64
rpm-devel-6.0.0-1.amzn2027.0.6.aarch64
rpm-debugsource-6.0.0-1.amzn2027.0.6.aarch64
rpm-libs-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-build-libs-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-syslog-6.0.0-1.amzn2027.0.6.aarch64
rpm-sign-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-unshare-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-build-6.0.0-1.amzn2027.0.6.aarch64
rpm-build-libs-6.0.0-1.amzn2027.0.6.aarch64
rpm-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
python3-rpm-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-fapolicyd-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-sign-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-libs-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-selinux-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-build-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-dbus-announce-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-selinux-6.0.0-1.amzn2027.0.6.aarch64
rpm-sign-libs-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-ima-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-ima-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
python3-rpm-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-fapolicyd-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-dbus-announce-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-syslog-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-prioreset-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-audit-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-audit-6.0.0-1.amzn2027.0.6.aarch64
rpm-devel-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-plugin-systemd-inhibit-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
rpm-6.0.0-1.amzn2027.0.6.aarch64
rpm-sign-libs-debuginfo-6.0.0-1.amzn2027.0.6.aarch64
noarch:
rpm-cron-6.0.0-1.amzn2027.0.6.noarch
rpm-apidocs-6.0.0-1.amzn2027.0.6.noarch
src:
rpm-6.0.0-1.amzn2027.0.6.src
x86_64:
rpm-build-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-audit-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-syslog-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-unshare-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-sign-libs-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-sign-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-unshare-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-fapolicyd-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-selinux-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-libs-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-dbus-announce-6.0.0-1.amzn2027.0.6.x86_64
rpm-build-libs-6.0.0-1.amzn2027.0.6.x86_64
rpm-devel-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-build-libs-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-fapolicyd-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-selinux-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-systemd-inhibit-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-build-6.0.0-1.amzn2027.0.6.x86_64
rpm-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-libs-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-dbus-announce-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-debugsource-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-prioreset-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-ima-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-systemd-inhibit-6.0.0-1.amzn2027.0.6.x86_64
rpm-sign-libs-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-syslog-6.0.0-1.amzn2027.0.6.x86_64
python3-rpm-debuginfo-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-ima-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-prioreset-6.0.0-1.amzn2027.0.6.x86_64
rpm-devel-6.0.0-1.amzn2027.0.6.x86_64
rpm-sign-6.0.0-1.amzn2027.0.6.x86_64
rpm-plugin-audit-6.0.0-1.amzn2027.0.6.x86_64
rpm-6.0.0-1.amzn2027.0.6.x86_64
python3-rpm-6.0.0-1.amzn2027.0.6.x86_64