CVE-2019-14866: gnu cpio Improper Input Validation

Vulnerability summary

CVE-2019-14866 is a high (CVSS 7.3) Improper Input Validation vulnerability in gnu cpio. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 51.7% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 07-01-2020
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.