Bugzilla – Bug 1155199
VUL-0: CVE-2019-14866: cpio: improper input validation when writing tar header fields leads to unexpect tar generation
Last modified: 2020-07-10 13:44:50 UTC
from rh bugzilla cpio does not properly validate the values written in the header of a TAR file through the to_oct() function. When creating a TAR file from a list of files and one of those is another TAR file with a big size, cpio will generate the resulting file with the content extracted from the input one. This leads to unexpected results as the newly generated TAR file could have files with permissions the owner of the input TAR file did not have or in paths he did not have access to. References: https://lists.gnu.org/archive/html/bug-cpio/2019-08/msg00003.html Proposed patch: https://cement.retrofitta.se/tmp/cpio-tar.patch
An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2019-11-22. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/64396
SUSE-SU-2019:3059-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1155199 CVE References: CVE-2019-14866 Sources used: SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): cpio-2.12-3.3.1 SUSE Linux Enterprise Module for Basesystem 15 (src): cpio-2.12-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:3064-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1155199 CVE References: CVE-2019-14866 Sources used: SUSE Linux Enterprise Server 12-SP5 (src): cpio-2.11-36.6.1 SUSE Linux Enterprise Server 12-SP4 (src): cpio-2.11-36.6.1 SUSE Linux Enterprise Desktop 12-SP4 (src): cpio-2.11-36.6.1 SUSE CaaS Platform 3.0 (src): cpio-2.11-36.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:2593-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1155199 CVE References: CVE-2019-14866 Sources used: openSUSE Leap 15.0 (src): cpio-2.12-lp150.2.3.1
openSUSE-SU-2019:2596-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1155199 CVE References: CVE-2019-14866 Sources used: openSUSE Leap 15.1 (src): cpio-2.12-lp151.3.3.1
Done