SUSE-SU-2024:0825-1: Security update for cpio
This update for cpio fixes the following issues: Fixed cpio not extracting correctly when using --no-absolute-filenames option the security fix for CVE-2023-7207 (bsc#1218571, bsc#1219238)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/cpioto a version that resolves this vulnerability.Fixed in 2.11-36.21.1 - Upgrade
Upgrade
suse/cpio-debugsourceto a version that resolves this vulnerability.Fixed in 2.11-36.21.1 - Upgrade
Upgrade
suse/cpio-debuginfoto a version that resolves this vulnerability.Fixed in 2.11-36.21.1 - Upgrade
Upgrade
suse/cpio-langto a version that resolves this vulnerability.Fixed in 2.11-36.21.1 - Upgrade
Upgrade
cpioto a version that resolves this vulnerability.Patch SUSE-SLE-SERVER-12-SP5-2024-825=1
Event History
Frequently Asked Questions
Which SUSE environments are covered by this update?
The update applies to SUSE Linux Enterprise Server 12 SP5 on aarch64, ppc64le, s390x, and x86_64, and to SUSE Linux Enterprise High Performance Computing 12 SP5 on aarch64 and x86_64. Noarch packages for both products are also listed.
Which installed packages should be checked during remediation?
Check for the cpio package and its associated cpio-debugsource, cpio-debuginfo, and cpio-lang packages. The update includes the fix associated with CVE-2023-7207.