CVE-2019-14866
Summary
| CVE | CVE-2019-14866 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-01-07 17:15:00 UTC |
| Updated | 2023-06-04 22:15:00 UTC |
| Description | In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Gnu | Cpio | All | All | All | All |
| Application | Gnu | Cpio | All | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] [DLA 3445-1] cpio security update | MISC | lists.debian.org | |
| 1765511 – (CVE-2019-14866) CVE-2019-14866 cpio: improper input validation when writing tar header fields leads to unexpect tar generation | CONFIRM | bugzilla.redhat.com | Exploit, Issue Tracking, Mitigation, Patch, Third Party Advisory |
| Red Hat Customer Portal - Access to 24x7 support and knowledge | MISC | access.redhat.com | |
| [Bug-cpio] [PATCH] Check for size overflow in tar header fields | MISC | lists.gnu.org | Mailing List, Patch, Third Party Advisory |
| 1765511 – (CVE-2019-14866) CVE-2019-14866 cpio: improper input validation when writing tar header fields leads to unexpect tar generation | MISC | bugzilla.redhat.com | |
| Red Hat Customer Portal - Access to 24x7 support and knowledge | MISC | access.redhat.com | |
| Red Hat Customer Portal - Access to 24x7 support and knowledge | MISC | access.redhat.com | |
| cpio-2.13 released [stable] | MISC | lists.gnu.org | Exploit, Mailing List, Third Party Advisory |
| Red Hat Customer Portal | MISC | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159187 Oracle Enterprise Linux Security Update for cpio (ELSA-2021-1582)
- 181827 Debian Security Update for cpio (DLA 3445-1)
- 239337 Red Hat Update for cpio (RHSA-2021:1582)
- 239988 Red Hat Update for cpio (RHSA-2022:0073)
- 377503 Alibaba Cloud Linux Security Update for cpio (ALINUX2-SA-2020:0131)
- 500862 Alpine Linux Security Update for cpio
- 504655 Alpine Linux Security Update for cpio
- 940193 AlmaLinux Security Update for cpio (ALSA-2021:1582)
- 960855 Rocky Linux Security Update for cpio (RLSA-2021:1582)