Security readout for executives and security teams
Plain-English summary
This CVE affects old RPM build tooling. If someone convinces a user or build system to process a malicious RPM spec file, rpmbuild may misparse it and remove home-directory content. The issue is user-assisted and tied to legacy RPM versions, so urgency depends on whether untrusted spec files are built in your environment.
Executive priority
Treat this as a targeted legacy build-chain risk, not a broad internet-facing emergency. Prioritize environments that build RPM packages from external contributions or third-party spec files.
Technical view
rpmbuild in RPM 4.8.0 and earlier improperly parses spec file syntax. The CVE describes a malformed Name tag pattern that can cause unintended removal of home directories. The public bundle does not provide CVSS, CWE classification, confirmed fixed versions, or detailed vendor remediation guidance.
Likely exposure
Exposure is most likely on legacy Linux build hosts, packaging pipelines, or developer systems still using RPM 4.8.0 or earlier and building spec files from outside trusted repositories.
Exploitation context
The provided sources describe user-assisted remote attack potential, but the CVE is not listed as KEV and no source in the bundle confirms active exploitation.
Researcher notes
The bundle is sparse: affected scope is stated only as RPM 4.8.0 and earlier, with no CVSS, CWE, patch version, or exploitation evidence. Further validation should focus on vendor advisories and local build workflow exposure.
Mitigation direction
- Inventory systems and build images using rpmbuild or RPM 4.8.0 and earlier.
- Avoid building RPM spec files from untrusted sources.
- Check your Linux vendor guidance for fixed RPM packages or supported backports.
- Run package builds in isolated, disposable build environments.
- Ensure reliable backups for developer home and build directories.
Validation and detection
- Confirm installed RPM and rpmbuild versions on build hosts and developer workstations.
- Review CI jobs for RPM spec files pulled from untrusted or user-submitted sources.
- Check vendor advisories for the exact fixed package applicable to each distribution.
- Verify build workers are isolated from persistent user home directories.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2010-2197 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- rpm-rpmbuild-weak-security(59423)CVE reference · vdb-entry, x_refsource_XF
- https://bugzilla.redhat.com/show_bug.cgi?id=125517CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.