Moderate: cpio security update
Summary
ALSA-2022:1991: Moderate: cpio security update. Affects cpio versions < 2.12-11.el8. Fixed in 2.12-11.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cpio packages provide the GNU cpio utility for creating and extracting archives, or copying files from one place to another. It is commonly used in Linux systems for managing file archives. The cpio utility supports various archive formats and provides options for compression and encryption. This vulnerability affects the cpio package in AlmaLinux 8.
Vulnerability Detail
The vulnerability identified as CVE-2021-38185 is an integer overflow issue in the ds_fgetstr() function in dstring.c file of the cpio package. This vulnerability can be exploited by an attacker by providing a crafted pattern file, leading to an out-of-bounds write. The impact of this vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition on the affected system.
How To Fix
Minimum fixed version
2.12-11.el8
This is the first release that contains the fix.
sudo dnf update cpioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The cpio package in AlmaLinux 8 is affected by a moderate-level vulnerability (CVE-2021-38185) that can lead to an out-of-bounds write. It is important to update the cpio package to version 2.12-11.el8 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for cpio →
FAQ
cpio is a utility used for creating and extracting archives, or copying files from one place to another. It is commonly used in Linux systems for managing file archives.
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition on the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time monitoring and alerts for open-source vulnerabilities.
No specific workaround has been provided for this vulnerability. It is recommended to update the cpio package to the latest version.
You can refer to the CVE page for CVE-2021-38185 for more detailed information about this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpio.
