{"id":"CVE-2019-14866","aliases":["ALPINE-CVE-2019-14866","BELL-CVE-2019-14866","DEBIAN-CVE-2019-14866","DLA-1981-1","DLA-3445-1","EUVD-2019-5982","GHSA-g3pr-277r-xcx7","MGASA-2019-0326","RHSA-2020:3908","RHSA-2021:1582","RHSA-2022:0073","RLSA-2021:1582","SUSE-SU-2019:3059-1","SUSE-SU-2019:3064-1","UBUNTU-CVE-2019-14866","USN-4176-1","openSUSE-SU-2019:2593-1","openSUSE-SU-2019:2596-1","openSUSE-SU-2024:10697-1"],"status":"published","title":"In all versions of cpio before 2.13 does not properly validate input files when generating TAR...","description":"In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.","severity":{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00686,"percentile":0.52979,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2019-11-02T00:00:00Z","modified":"2026-11-03T06:32:35Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cpio","fixed_in":["2.13-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cpio","fixed_in":["2.13+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cpio","fixed_in":["2.13+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cpio","fixed_in":["2.13+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"cpio","fixed_in":["2.11+dfsg-4.1+deb8u2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"cpio","fixed_in":["0:2.11-28.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"cpio-debuginfo","fixed_in":["0:2.11-28.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cpio","fixed_in":["0:2.11-28.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cpio-debuginfo","fixed_in":["0:2.11-28.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"cpio","fixed_in":["0:2.11-28.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"cpio-debuginfo","fixed_in":["0:2.11-28.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cpio","fixed_in":["0:2.11-28.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cpio-debuginfo","fixed_in":["0:2.11-28.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cpio","fixed_in":["0:2.12-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cpio-debuginfo","fixed_in":["0:2.12-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cpio-debugsource","fixed_in":["0:2.12-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cpio","fixed_in":["0:2.12-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cpio-debuginfo","fixed_in":["0:2.12-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cpio-debugsource","fixed_in":["0:2.12-8.el8_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"cpio","fixed_in":["0:2.12-10.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"cpio","fixed_in":["2.12-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"cpio","fixed_in":["2.12-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"cpio","fixed_in":["2.11-36.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"cpio","fixed_in":["2.11-36.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"cpio","fixed_in":["2.11-36.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"cpio","fixed_in":["2.11-36.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cpio","fixed_in":["2.11-36.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","fixed_in":["2.11+dfsg-1ubuntu1.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"cpio","fixed_in":["2.11+dfsg-5ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"cpio","fixed_in":["2.12+dfsg-6ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"cpio","fixed_in":["2.12-lp150.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"cpio","fixed_in":["2.12-lp151.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-4.1+deb8u2"}]}],"versions":["2.11+dfsg-4.1","2.11+dfsg-4.1+deb8u1"]},{"source":"osv","ecosystem":"Debian:10","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12+dfsg-9+deb10u1"}]}],"versions":["2.12+dfsg-9"],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-28.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-28.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-28.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-28.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-28.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-28.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-28.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-28.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cpio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"cpio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-8.el8_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-10.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-1ubuntu1.2+esm1"}]}],"versions":["2.11+dfsg-1ubuntu1","2.11+dfsg-1ubuntu1.1","2.11+dfsg-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-5ubuntu1.1"}]}],"versions":["2.11+dfsg-4.1ubuntu1","2.11+dfsg-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12+dfsg-6ubuntu0.18.04.1"}]}],"versions":["2.11+dfsg-6","2.12+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-1ubuntu1.2+esm1"}]}],"versions":["2.11+dfsg-1ubuntu1","2.11+dfsg-1ubuntu1.1","2.11+dfsg-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-5ubuntu1.1"}]}],"versions":["2.11+dfsg-4.1ubuntu1","2.11+dfsg-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12+dfsg-6ubuntu0.18.04.1"}]}],"versions":["2.11+dfsg-6","2.12+dfsg-6"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-lp150.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-3.3"}]}],"bundled":3}],"products":[{"vendor":"gnu","product":"cpio"},{"vendor":"red hat","product":"cpio"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14866","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Mitigation","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.gnu.org/archive/html/bug-cpio/2019-08/msg00003.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00007.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14866","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3908","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1582","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0073","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1765511","tags":["report"]},{"url":"https://github.com/advisories/GHSA-g3pr-277r-xcx7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-14866","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-14866","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14866","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0326.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25680","tags":["report"]},{"url":"https://usn.ubuntu.com/4176-1/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3908.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14866","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487673","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1582.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0073.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1582","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193059-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1155199","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14866","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193064-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-14866","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4176-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S6XCUOVCXNQ6F2SKISA7LWT5WFS5W7MT/#S6XCUOVCXNQ6F2SKISA7LWT5WFS5W7MT","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAJR4QB4A2YQ5MYPKKBZWQZEHXTFQ2KX/#GAJR4QB4A2YQ5MYPKKBZWQZEHXTFQ2KX","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38185","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-14866","description":"In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.","status":"published","published":"2020-01-07T16:53:51Z","modified":"2025-02-13T16:27:23.692Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:20:18.085548Z"}],"euvd":[{"id":"EUVD-2019-5982","description":"In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.","status":"published","published":"2020-01-07T16:53:51Z","modified":"2025-02-13T16:27:23Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-g3pr-277r-xcx7","title":"In all versions of cpio before 2.13 does not properly validate input files when generating TAR...","description":"In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.","status":"published","published":"2022-05-24T17:05:42Z","modified":"2023-06-05T00:30:18Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:54:37.773458Z"}],"nvd":[{"id":"CVE-2019-14866","description":"In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.","status":"published","published":"2020-01-07T17:15:11.377Z","modified":"2026-06-17T02:19:12.09Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:05:42.416368Z"}],"osv":[{"id":"ALPINE-CVE-2019-14866","description":"In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.","status":"published","published":"2020-01-07T17:15:11.377Z","modified":"2026-11-03T06:32:35.037561949Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"BELL-CVE-2019-14866","title":"CVE-2019-14866 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:54.109555Z","modified":"2026-01-26T09:49:12.014011Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-14866","description":"In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.","status":"published","published":"2020-01-07T17:15:11.377Z","modified":"2026-04-16T04:37:28.091270795Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14866","description":"In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.","status":"published","published":"2020-01-07T17:15:11.377Z","modified":"2026-09-21T07:02:42.71410515Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2020:3908","title":"Red Hat Security Advisory: cpio security update","status":"published","published":"2024-09-16T03:48:10Z","modified":"2026-06-26T10:50:17Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2021:1582","title":"Red Hat Security Advisory: cpio security update","status":"published","published":"2024-09-16T03:48:24Z","modified":"2025-11-22T12:19:55Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2022:0073","title":"Red Hat Security Advisory: cpio security update","status":"published","published":"2024-09-16T03:48:31Z","modified":"2025-11-22T12:28:56Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RLSA-2021:1582","title":"Moderate: cpio security update","description":"The cpio packages provide the GNU cpio utility for creating and extracting archives, or copying files from one place to another.\n\nSecurity Fix(es):\n\n* cpio: improper input validation when writing tar header fields leads to unexpected tar generation (CVE-2019-14866)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.","status":"published","published":"2021-05-18T05:34:34Z","modified":"2026-02-04T12:45:12.662038Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-14866","description":"In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.","status":"published","published":"2019-11-02T00:00:00Z","modified":"2026-02-04T02:47:38.9669Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-1981-1","title":"cpio - security update","status":"published","published":"2019-11-05T00:00:00Z","modified":"2026-03-09T01:17:56.605686Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-3445-1","title":"cpio - security update","status":"published","published":"2023-06-04T00:00:00Z","modified":"2026-03-09T01:23:01.987372Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2019-0326","title":"Updated cpio packages fix security vulnerabilities","description":"in cpio 2.11, when using the --no-absolute-filenames option, allows local\nusers to write to arbitrary files via a symlink attack on a file in an\narchive (CVE-2015-1197).\n\nThomas Habets discovered that GNU cpio incorrectly handled certain\ninputs. An attacker could possibly use this issue to privilege escalation\n(CVE-2019-14866).\n\ncpio has been updated to 2.13 that fixes theese issues.\n","status":"published","published":"2019-11-14T16:58:51Z","modified":"2026-04-16T04:42:31.80135142Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2593-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2019-14866: Fixed an improper validation of the values written \n  in the header of a TAR file through the to_oct() function which could \n  have led to unexpected TAR generation (bsc#1155199).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-11-30T19:16:20Z","modified":"2026-02-04T03:53:56.993602Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2019:2596-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2019-14866: Fixed an improper validation of the values written \n  in the header of a TAR file through the to_oct() function which could \n  have led to unexpected TAR generation (bsc#1155199).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-11-30T19:16:55Z","modified":"2026-02-04T02:51:14.731319Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10697-1","title":"cpio-2.13-3.3 on GA media","description":"These are all security issues fixed in the cpio-2.13-3.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:34:12.536678Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:3059-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- CVE-2019-14866: Fixed an improper validation of the values written \n  in the header of a TAR file through the to_oct() function which could \n  have led to unexpected TAR generation (bsc#1155199).\n","status":"published","published":"2019-11-25T16:33:11Z","modified":"2026-02-04T03:05:28.412416Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:3064-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\t  \n- CVE-2019-14866: Fixed an improper validation of the values written \n  in the header of a TAR file through the to_oct() function which could \n  have led to unexpected TAR generation (bsc#1155199).\n","status":"published","published":"2019-11-25T17:44:45Z","modified":"2026-02-04T04:24:59.63592Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4176-1","title":"cpio vulnerability","description":"Thomas Habets discovered that GNU cpio incorrectly handled certain inputs.\nAn attacker could possibly use this issue to privilege escalation.\n","status":"published","published":"2019-11-06T16:05:15Z","modified":"2026-06-29T13:47:43.177881378Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}