CVE-2023-7207

NameCVE-2023-7207
DescriptionDebian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1059163

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cpio (PTS)jessie, jessie (lts)2.11+dfsg-4.1+deb8u4fixed
stretch (lts), stretch2.11+dfsg-6+deb9u1fixed
buster (security), buster, buster (lts)2.12+dfsg-9+deb10u1fixed
bullseye2.13+dfsg-7.1~deb11u1vulnerable
bookworm2.13+dfsg-7.1vulnerable
sid, trixie2.15+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cpiosourcejessie(not affected)
cpiosourcestretch(not affected)
cpiosourcebuster(not affected)
cpiosource(unstable)2.14+dfsg-11059163

Notes

[bookworm] - cpio <no-dsa> (Minor issue)
[bullseye] - cpio <no-dsa> (Minor issue)
[buster] - cpio <not-affected> (Partial CVE-2015-1197 patch revert not applied)
https://www.openwall.com/lists/oss-security/2023/12/21/8
Fixed by: https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628 (v2.14)
[stretch] - cpio <not-affected> (Partial CVE-2015-1197 patch revert not applied)
[jessie] - cpio <not-affected> (Partial CVE-2015-1197 patch revert not applied)

Search for package or bug name: Reporting problems