SUSE-SU-2024:0248-1: Security update for cpio
This update for cpio fixes the following issues: CVE-2023-7207: Fixed a path traversal issue that could lead to an arbitrary file write during archive extraction (bsc#1218571).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/cpio-debugsourceto a version that resolves this vulnerability.Fixed in 2.11-36.18.1 - Upgrade
Upgrade
suse/cpio-debuginfoto a version that resolves this vulnerability.Fixed in 2.11-36.18.1 - Upgrade
Upgrade
suse/cpioto a version that resolves this vulnerability.Fixed in 2.11-36.18.1 - Upgrade
Upgrade
suse/cpio-langto a version that resolves this vulnerability.Fixed in 2.11-36.18.1 - Upgrade
Upgrade
cpioto a version that resolves this vulnerability.Patch SUSE-SLE-SERVER-12-SP5-2024-248=1
Event History
Frequently Asked Questions
What systems are covered by this update?
The update applies to cpio packages on SUSE Linux Enterprise Server 12 SP5 and SUSE Linux Enterprise High Performance Computing 12 SP5, including the listed aarch64, ppc64le, s390x, x86_64, and noarch builds.
When could this issue be exploited?
Exploitation requires cpio to extract an archive containing path traversal entries. A successful attack could write files to arbitrary paths during extraction.
How can I determine whether a system needs remediation?
Identify systems running the affected cpio package on the listed SUSE 12 SP5 products and determine whether they extract archives from untrusted sources. Apply the SUSE security update for cpio.