CVE-2019-14866 - CVE House

Back to Database

Status published Medium CVE-2019-14866

In all versions of cpio before 2.13 does not properly...

6.7 CVSS

Vulnerability Description

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-14866

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Red Hat

View All →

Aap-gateway: improper path validation in gateway allows credential exfiltration

Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

Libsoup: improper handling of http vary header in libsoup caching

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Affected Vendor

Red Hat

View all reports →

Affected Software

cpio

Vulnerable Versions:

All cpio versions before 2.13

Timeline

Official Publish: January 7th, 2020

Last Modified: February 13th, 2025

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation