USN-6755-1: GNU cpio vulnerabilities

Releases

• Ubuntu 23.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• cpio - a tool to manage archives of files

Details

Ingo Brückl discovered that cpio contained a path traversal vulnerability.
If a user or automated system were tricked into extracting a specially
crafted cpio archive, an attacker could possibly use this issue to write
arbitrary files outside the target directory on the host, even if using the
option --no-absolute-filenames.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.10

• cpio - 2.13+dfsg-7.1ubuntu0.1

Ubuntu 22.04

• cpio - 2.13+dfsg-7ubuntu0.1

Ubuntu 20.04

• cpio - 2.13+dfsg-2ubuntu0.4

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-7207