rpm

rpm 4.20.1 · pkgs/tools/package-management/rpm/default.nix

Health

Risk

risk 82 critical

+60 5 open advisories
+4 NIXPKGS-2026-2488 has a 1% chance of exploitation in 30 days (EPSS)
+12 4.20.1 is behind upstream 6.1.0, a major release
+6 no maintainer

Version

4.20.1 upstream 6.1.0

Channels

master 4.20.1 · nixos-unstable 4.20.1 · nixos-26.05 4.20.1 no channel is behind master

Hydra

succeeded 2d ago

Advisories

NIXPKGS-2026-2488 high 7.8 EPSS 1.3% Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path · #559506

CVE-2026-84837

NIXPKGS-2026-1794 high 7.0 EPSS 0.9% · #526344

CVE-2026-44604

NIXPKGS-2026-2755 high 7.8 EPSS 0.6% Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm · #566789

CVE-2026-95521

NIXPKGS-2026-2751 high 7.8 EPSS 0.1% Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows) · #566785

CVE-2026-95519

NIXPKGS-2026-2359 medium 5.5 EPSS 0.2% Rpm: heap buffer overflow in ndb slot table parsing · #549784

CVE-2026-44605

Packaging

not read yet: the next index sweep reads it

Maintainers

none

Pull requests 3

treewide: use systemdLibs for desktop and administration tools

#569820 by RaitoBezarius · opened 13d ago · checks pass

treewide: remove obsolete instances of darwinMinVersionHook

#462019 by niklaskorz · opened 11mo ago · checks pass