USN-6755-1: GNU cpio vulnerabilities
Ingo Brückl discovered that cpio contained a path traversal vulnerability. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to write arbitrary files outside the target directory on the host, even if using the option --no-absolute-filenames.
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-6755-1?
The USN-6755-1 vulnerability is considered a high-severity path traversal issue.
How do I fix USN-6755-1?
To fix USN-6755-1, upgrade cpio to version 2.13+dfsg-7.1ubuntu0.1 or later on affected Ubuntu versions.
Which versions of cpio are affected by USN-6755-1?
Versions of cpio prior to 2.13+dfsg-7.1ubuntu0.1 on Ubuntu 23.10, 22.04, and 20.04 are affected by USN-6755-1.
What type of vulnerability is described in USN-6755-1?
USN-6755-1 describes a path traversal vulnerability that allows attackers to write arbitrary files outside the intended directory.
Who discovered the USN-6755-1 vulnerability?
The USN-6755-1 vulnerability was discovered by Ingo Brückl.