CVE-2023-49298

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-49298
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49298.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-49298
Downstream
Published
2023-11-24T19:15:07.587Z
Modified
2026-04-02T09:39:48.149031Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.

References

Affected packages

Git / github.com/openzfs/zfs

Affected ranges

Type
GIT
Repo
https://github.com/openzfs/zfs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
eb62221ff0f9efbc2ab826ec6f1388c5f05fb664
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
95785196f26e92d82cf4445654ba84e4a9671c57
Fixed
d99134be83753266b5f7a79738aeab5b08db1e35
Fixed
494aaaed89cb9fe9f2da3b6c6f465a4bc9f6a7e1
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.1.13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.2.0-NA"
        }
    ]
}

Affected versions

zfs-0.*
zfs-0.4.0
zfs-0.4.1
zfs-0.4.2
zfs-0.4.3
zfs-0.4.4
zfs-0.4.5
zfs-0.4.6
zfs-0.4.7
zfs-0.4.8
zfs-0.4.9
zfs-0.5.0
zfs-0.5.1
zfs-0.5.2
zfs-0.6.0-rc1
zfs-0.6.0-rc10
zfs-0.6.0-rc11
zfs-0.6.0-rc12
zfs-0.6.0-rc13
zfs-0.6.0-rc14
zfs-0.6.0-rc2
zfs-0.6.0-rc3
zfs-0.6.0-rc4
zfs-0.6.0-rc5
zfs-0.6.0-rc6
zfs-0.6.0-rc7
zfs-0.6.0-rc8
zfs-0.6.0-rc9
zfs-0.6.1
zfs-0.6.2
zfs-0.6.3
zfs-0.6.3-1.1
zfs-0.6.3-1.2
zfs-0.6.3-1.3
zfs-0.6.4
zfs-0.6.4.1
zfs-0.6.4.2
zfs-0.6.5
zfs-0.6.5.1
zfs-0.6.5.10
zfs-0.6.5.11
zfs-0.6.5.2
zfs-0.6.5.3
zfs-0.6.5.4
zfs-0.6.5.5
zfs-0.6.5.6
zfs-0.6.5.7
zfs-0.6.5.8
zfs-0.6.5.9
zfs-0.7.0
zfs-0.7.0-rc1
zfs-0.7.0-rc2
zfs-0.7.0-rc3
zfs-0.7.0-rc4
zfs-0.7.0-rc5
zfs-0.7.1
zfs-0.7.10
zfs-0.7.11
zfs-0.7.12
zfs-0.7.13
zfs-0.7.2
zfs-0.7.3
zfs-0.7.4
zfs-0.7.5
zfs-0.7.6
zfs-0.7.7
zfs-0.7.8
zfs-0.7.9
zfs-0.8.0
zfs-0.8.0-rc1
zfs-0.8.0-rc2
zfs-0.8.0-rc3
zfs-0.8.0-rc4
zfs-0.8.0-rc5
zfs-0.8.1
zfs-0.8.2
zfs-0.8.3
zfs-0.8.4
zfs-0.8.5
zfs-0.8.6
zfs-2.*
zfs-2.0.0
zfs-2.0.0-rc1
zfs-2.0.0-rc2
zfs-2.0.0-rc3
zfs-2.0.0-rc4
zfs-2.0.0-rc5
zfs-2.0.0-rc6
zfs-2.0.0-rc7
zfs-2.0.1
zfs-2.0.2
zfs-2.0.3
zfs-2.0.4
zfs-2.0.5
zfs-2.0.6
zfs-2.0.7
zfs-2.1.0
zfs-2.1.0-rc1
zfs-2.1.0-rc2
zfs-2.1.0-rc3
zfs-2.1.0-rc4
zfs-2.1.0-rc5
zfs-2.1.0-rc6
zfs-2.1.0-rc7
zfs-2.1.0-rc8
zfs-2.1.1
zfs-2.1.10
zfs-2.1.11
zfs-2.1.12
zfs-2.1.13
zfs-2.1.2
zfs-2.1.3
zfs-2.1.4
zfs-2.1.5
zfs-2.1.6
zfs-2.1.7
zfs-2.1.8
zfs-2.1.9
zfs-2.1.99
zfs-2.2.0
zfs-2.2.0-rc1
zfs-2.2.0-rc2
zfs-2.2.0-rc3
zfs-2.2.0-rc4
zfs-2.2.0-rc5
zfs-2.2.99
zfs-2.3.0
zfs-2.3.0-rc1
zfs-2.3.0-rc2
zfs-2.3.0-rc3
zfs-2.3.0-rc4
zfs-2.3.0-rc5
zfs-2.3.1
zfs-2.3.2
zfs-2.3.3
zfs-2.3.4
zfs-2.3.5
zfs-2.3.6
zfs-2.3.99
zfs-2.4.0
zfs-2.4.0-rc1
zfs-2.4.0-rc2
zfs-2.4.0-rc3
zfs-2.4.0-rc4
zfs-2.4.0-rc5
zfs-2.4.1
zfs-2.4.99

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49298.json"