In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 6.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cpio | May 4, 2022 | Jan 7, 2020 |
| Alpine Linux | — | Upgrade cpio | Aug 22, 2024 | Jan 7, 2020 |
| Amazon Linux Ami 2 | — | Upgrade cpio-debuginfoUpgrade cpio | Oct 28, 2020 | Jan 7, 2020 |
| Centos_linux | — | Upgrade cpioUpgrade cpio-debuginfoUpgrade cpio-debugsource | Oct 1, 2020 | Jan 7, 2020 |
| Debian | — | Upgrade cpio | Nov 7, 2019 | Nov 7, 2019 |
| Freebsd | — | Upgrade gcpio | Nov 16, 2019 | Nov 15, 2019 |
| Gentoo Linux | — | Upgrade app-arch/cpio. | Jul 3, 2024 | Jan 7, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade cpio | Jun 17, 2020 | Jan 7, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade cpio | Apr 16, 2020 | Jan 7, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade cpio | Dec 27, 2019 | Dec 23, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade cpio | Jan 3, 2020 | Dec 23, 2019 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle_linux | — | Upgrade cpio | Oct 7, 2020 | Aug 30, 2019 |
| Redhat_linux | — | Upgrade cpio-debugsourceUpgrade cpioUpgrade cpio-debuginfoNo solution exists | Oct 1, 2020 | Jan 7, 2020 |
| Rocky_linux | — | Upgrade cpio-debuginfoUpgrade cpio-debugsourceUpgrade cpio | Mar 12, 2024 | Jan 7, 2020 |
| Suse | — | Upgrade cpio-mtUpgrade cpio-langUpgrade cpio | Nov 27, 2019 | Nov 6, 2019 |
| Ubuntu | — | Upgrade cpioUpgrade cpio (Ubuntu Pro) | Nov 7, 2019 | Nov 6, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub