SB2021052018 - Red Hat Enterprise Linux 8 update for cpio
Published: May 20, 2021
Security Bulletin ID
SB2021052018
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2019-14866)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to GNU cpio does not properly validate files when writing tar headers during tar archive creation. A local user can trick the victim into creating a tar archive out of a directory with specially crafted files. As a result the generated archive may contain files that the attacker does not have access to.
Remediation
Install update from vendor's website.