Cpio: extraction allows symlinks which enables remote command execution
Vulnerability Description
A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-7216
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Red Hat would like to thank Febin Mon Saji for reporting this issue.
References
More from Red Hat
View All →Affected Vendor
Red Hat
View all reports →