Skip to content
Heist/ feed
MediumFix available

Security update for rpm

Type: advisorySource: OSV1 source record

This update for rpm fixes the following issue: Security issues fixed: - CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot table (bsc#1269584). Other updates and bugfixes: - Fix `libelf` handle not being closed, resulting in build errors when using a NFS buildroot (bsc#1240054).

Announced Source revision 1
Original source ↗

SUSE-SU-2026:4457-1

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:SUSE-SU-2026:4457-1

python-rpm

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
4.14.3-150300.58.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

rpm

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
4.14.3-150300.58.1

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

rpm-ndb

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
4.14.3-150300.58.1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.14.3-150300.58.1"
          }
        ]
      }
    ],
    "package": {
      "name": "python-rpm",
      "purl": "pkg:rpm/suse/python-rpm&distro=SUSE%20Linux%20Enterprise%20Micro%205.3",
      "ecosystem": "SUSE:Linux Enterprise Micro 5.3"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4457-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "rpm": "4.14.3-150300.58.1",
          "rpm-ndb": "4.14.3-150300.58.1",
          "python3-rpm": "4.14.3-150300.58.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.14.3-150300.58.1"
          }
        ]
      }
    ],
    "package": {
      "name": "rpm",
      "purl": "pkg:rpm/suse/rpm&distro=SUSE%20Linux%20Enterprise%20Micro%205.3",
      "ecosystem": "SUSE:Linux Enterprise Micro 5.3"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4457-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "rpm": "4.14.3-150300.58.1",
          "rpm-ndb": "4.14.3-150300.58.1",
          "python3-rpm": "4.14.3-150300.58.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.14.3-150300.58.1"
          }
        ]
      }
    ],
    "package": {
      "name": "rpm-ndb",
      "purl": "pkg:rpm/suse/rpm-ndb&distro=SUSE%20Linux%20Enterprise%20Micro%205.3",
      "ecosystem": "SUSE:Linux Enterprise Micro 5.3"
    },
    "database_specific": {
      "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4457-1.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "rpm": "4.14.3-150300.58.1",
          "rpm-ndb": "4.14.3-150300.58.1",
          "python3-rpm": "4.14.3-150300.58.1"
        }
      ]
    }
  }
]
Related CVEs
CVE-2026-44605

Source reference: /upstream

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-44605 · Medium

Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9

Event
#84444 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement