PT-2020-19694 · U Root · U-Root

Name of the Vulnerable Software and Affected Versions: u-root versions prior to 7.0.0 Description: The issue affects the cpio file extraction in the u-root package, making it vulnerable to leading and non-leading relative path traversal attacks, as well as symlink-based path traversal attacks, bo...

Huawei EulerOS: Security Advisory for cpio (EulerOS-SA-2020-1841)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : cpio (EulerOS-SA-2020-1841)

According to the version of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The cpiosafernamesuffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service out-of-bounds write via a crafted cpio...

Huawei EulerOS: Security Advisory for cpio (EulerOS-SA-2020-1737)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 3.0.6.0 : cpio (EulerOS-SA-2020-1737)

According to the version of the cpio package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TA...

Arbitrary File Write

github.com/sassoftware/go-rpmutils is vulnerable to arbitrary file write. The vulnerability exists as the extract function in cpio/extracttest.go does not restrict the filepath path to the dest, allowing extraction outside the permitted cpio path...

CVE-2020-7667

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all...

CVE-2020-7667

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all...

Design/Logic Flaw

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all...

CVE-2020-7667

In CVE-2020-7667, the go-rpmutils/cpio component allowed directory traversal via CPIO extraction due to improper sanitization of leading/non-leading “..” in archived paths. The fixing commit was applied to all affected versions and those releases were re-released; remediation is to update to a ve...

CVE-2020-7667

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all...

EulerOS 2.0 SP2 : cpio (EulerOS-SA-2020-1630)

According to the version of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from...

Huawei EulerOS: Security Advisory for cpio (EulerOS-SA-2020-1630)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for libarchive (FEDORA-2020-d8278fe24d)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for libarchive (FEDORA-2020-94211d0a7d)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/sassoftware/go-rpmutils/cpio is a package for parsing and extracting content from RPM files. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. The CPIO extraction functionality doesn't sanitize the paths of the archived...

[SECURITY] Fedora 32 Update: libarchive-3.4.3-1.fc32

Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives...

EulerOS Virtualization for ARM 64 3.0.2.0 : cpio (EulerOS-SA-2020-1522)

According to the version of the cpio package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR...

Huawei EulerOS: Security Advisory for cpio (EulerOS-SA-2020-1522)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for cpio (EulerOS-SA-2020-1375)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...