UBUNTU-CVE-2023-7207

Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.

References

Affected packages

Ubuntu:20.04:LTS / cpio

Package

Name: cpio
Purl: pkg:deb/ubuntu/cpio@2.13+dfsg-2ubuntu0.4?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.13+dfsg-2ubuntu0.4

Affected versions

2.*

2.12+dfsg-9

2.12+dfsg-9ubuntu1

2.13+dfsg-1

2.13+dfsg-2

2.13+dfsg-2ubuntu0.3

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.13+dfsg-2ubuntu0.4",
            "binary_name": "cpio"
        },
        {
            "binary_version": "2.13+dfsg-2ubuntu0.4",
            "binary_name": "cpio-win32"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:22.04:LTS / cpio

Package

Name: cpio
Purl: pkg:deb/ubuntu/cpio@2.13+dfsg-7ubuntu0.1?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.13+dfsg-7ubuntu0.1

Affected versions

2.*

2.13+dfsg-4ubuntu4

2.13+dfsg-7

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.13+dfsg-7ubuntu0.1",
            "binary_name": "cpio"
        },
        {
            "binary_version": "2.13+dfsg-7ubuntu0.1",
            "binary_name": "cpio-win32"
        }
    ],
    "availability": "No subscription required"
}