CVE-2019-14866: Input Validation
GNU cpio could allow a local authenticated attacker to gain elevated privileges on the system, caused by the failure to properly validate input files when generating TAR archives. An attacker could exploit this vulnerability to inject any tar content and compromise the system.
Other sources
In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID of this security issue is CVE-2019-14866.
What is the severity of CVE-2019-14866?
The severity of CVE-2019-14866 is high (7.3).
Which software versions are affected by this vulnerability?
IBM Security Guardium versions up to and including 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 are affected by this vulnerability. GNU cpio up to version 2.13 and Redhat Enterprise Linux versions 7.0 and 8.0 are also affected.
What is the impact of this vulnerability?
Exploiting this vulnerability could allow a local authenticated attacker to gain elevated privileges on the system.
How can this vulnerability be fixed?
To fix this vulnerability, it is recommended to upgrade to a patched version of cpio and apply any available security updates provided by vendors like IBM and Redhat.