We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Ok

THREATINT
PUBLISHED

CVE-2023-7216

Cpio: extraction allows symlinks which enables remote command execution

Reserved:2024-01-05
Published:2024-02-05
Updated:2024-05-13

Description

A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks.



MEDIUM: 5.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Problem types

Improper Link Resolution Before File Access ('Link Following')

Product status

Default status
unknown

Default status
affected

Default status
affected

Default status
affected

Timeline

2023-11-15:Reported to Red Hat.
2024-02-05:Made public.

Credits

Red Hat would like to thank Febin Mon Saji for reporting this issue.

References

https://access.redhat.com/security/cve/CVE-2023-7216 vdb-entry

https://bugzilla.redhat.com/show_bug.cgi?id=2249901 (RHBZ#2249901) issue-tracking

cve.org CVE-2023-7216

nvd.nist.gov CVE-2023-7216

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2023-7216