EulerOS Virtualization 3.0.2.2 : cpio (EulerOS-SA-2020-2216)

According to the version of the cpio package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - blktrace aka Block IO Tracing 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the devmapread function in...

cpio security update

CentOS Errata and Security Advisory CESA-2020:3908 An update for cpio is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CentOS 7 : cpio (RHSA-2020:3908)

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:3908 advisory. - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths a...

Oracle Linux 7 : cpio (ELSA-2020-3908)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-3908 advisory. 2.11-28 - Improper input validation when writing tar header fields 1766222 Tenable has extracted the preceding description block directly from the Oracle Linux...

cpio security update

2.11-28 - Improper input validation when writing tar header fields 1766222...

Arbitrary File Rewrite

The cpio packages is vulnerable to Arbitrary File Rewrite. Improper input validation when writing tar header fields leads to unexpect tar generation...

RHEL 7 : cpio (RHSA-2020:3908)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:3908 advisory. The cpio packages provide the GNU cpio utility for creating and extracting archives, or copying files from one place to another. Security Fixes: cpio...

Moderate: Red Hat Security Advisory: cpio security update

An update for cpio is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

cpio: improper input validation when writing tar header fields leads to unexpected tar generation

It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to...

EulerOS Virtualization for ARM 64 3.0.6.0 : cpio (EulerOS-SA-2020-2003)

According to the version of the cpio package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The cpiosafernamesuffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service out-of-bounds...

Huawei EulerOS: Security Advisory for cpio (EulerOS-SA-2020-2003)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization for ARM 64 3.0.2.0 : cpio (EulerOS-SA-2020-1962)

According to the version of the cpio package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attac...

Huawei EulerOS: Security Advisory for cpio (EulerOS-SA-2020-1962)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Arbitrary File Write

github.com/u-root/u-root/pkg/cpio is susceptible to arbitrary file write. The vulnerability exists because it uses filepath.Join without properly handling the file path for character / before performing cpio file extraction, therefore going out of the destination directory...

CVE-2020-7666

This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based relative and absolute path traversal attacks in cpio file extraction...

CVE-2020-7666

This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based relative and absolute path traversal attacks in cpio file extraction...

Path traversal

This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based relative and absolute path traversal attacks in cpio file extraction...

CVE-2020-7666

The CVE-2020-7666 entry concerns github.com/u-root/u-root/pkg/cpio, where the cpio extraction code is vulnerable to path traversal (leading and non-leading relative paths) and symlink-based traversal (relative and absolute) during archive extraction. Multiple sources describe this as Arbitrary Fi...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/u-root/u-root/pkg/cpio is a package that provides Go versions of standard Linux tools and bootloaders. It also provides tools for compiling Go programs in a single binary and creating initramfs images. Affected versions of this package are vulnerable to Arbitrary File Write vi...

PT-2020-19694 · U Root · U-Root

Name of the Vulnerable Software and Affected Versions: u-root versions prior to 7.0.0 Description: The issue affects the cpio file extraction in the u-root package, making it vulnerable to leading and non-leading relative path traversal attacks, as well as symlink-based path traversal attacks, bo...