In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 6.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-cpio | May 4, 2022 | Jan 7, 2020 | |
| Alpine Linux | alpine-linux-upgrade-cpio | Aug 22, 2024 | Jan 7, 2020 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-cpioamazon-linux-ami-2-upgrade-cpio-debuginfo | Oct 28, 2020 | Jan 7, 2020 | |
| Centos_linux | — | centos-upgrade-cpiocentos-upgrade-cpio-debuginfocentos-upgrade-cpio-debugsource | Oct 1, 2020 | Jan 7, 2020 |
| Debian | debian-upgrade-cpio | Nov 7, 2019 | Nov 7, 2019 | |
| Freebsd | freebsd-upgrade-package-gcpio | Nov 16, 2019 | Nov 15, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-app-arch-cpio | Jul 3, 2024 | Jan 7, 2020 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-cpio | Jun 17, 2020 | Jan 7, 2020 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-cpio | Apr 16, 2020 | Jan 7, 2020 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-cpio | Dec 27, 2019 | Dec 23, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-cpio | Jan 3, 2020 | Dec 23, 2019 | |
| Nutanix Ahv | nutanix-ahv-upgrade-latest | Jun 5, 2026 | Sep 19, 2022 | |
| Oracle_linux | — | oracle-linux-upgrade-cpio | Oct 7, 2020 | Aug 30, 2019 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-cpioredhat-upgrade-cpio-debuginforedhat-upgrade-cpio-debugsource | Oct 1, 2020 | Jan 7, 2020 | |
| Rocky_linux | rocky-upgrade-cpiorocky-upgrade-cpio-debuginforocky-upgrade-cpio-debugsource | Mar 12, 2024 | Jan 7, 2020 | |
| Suse | — | suse-upgrade-cpiosuse-upgrade-cpio-langsuse-upgrade-cpio-mt | Nov 27, 2019 | Nov 6, 2019 |
| Ubuntu | ubuntu-pro-upgrade-cpioubuntu-upgrade-cpio | Nov 7, 2019 | Nov 6, 2019 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jan 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub