CyberRota Analysis
AI-GeneratedA vulnerability exists in the rpm package management system that allows local attackers to exploit specially crafted `.gem` filenames containing RPM macro syntax. When the command `rpmuncompress -x` is executed on such a file, it can lead to arbitrary command execution with the privileges of the user running the command, potentially compromising system confidentiality, integrity, and availability. Organizations using rpm should prioritize patching this vulnerability to mitigate the risk of local privilege escalation and system compromise.
Original NVD Description
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.