{"schemaVersion":3,"id":"CVE-2021-38185","aliases":["MGASA-2021-0423","SUSE-RU-2021:2779-1","SUSE-RU-2021:2780-1","SUSE-SU-2021:14777-1","SUSE-SU-2021:14788-1","SUSE-SU-2021:2686-1","SUSE-SU-2021:2808-1","RHSA-2022:1991","UBUNTU-CVE-2021-38185","USN-5064-1","USN-5064-2","USN-5064-3","DEBIAN-CVE-2021-38185"],"status":"published","duplicateOf":null,"title":null,"description":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.","dates":{"published":"2021-08-07T00:00:00.000Z","modified":"2025-06-09T15:11:29.808Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Red hat","score":7,"severity":"high","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":2.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.04165,"percentile":0.90761,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.04165},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04165,"percentile":0.90761}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04165,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04165,"percentile":0.90761}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_FANGQYI_CPIOPWN","name":"Cpiopwn","source":"github","url":"https://github.com/fangqyi/cpiopwn","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_52D45C3E8A60F133","name":"Exploit Reference (lists.gnu.org)","source":"reference","url":"https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00000.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_D2A329C1D6C5A0F5","name":"Exploit Reference (lists.gnu.org)","source":"reference","url":"https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00002.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":3,"weaknesses":[{"id":"CWE-190","name":"Integer Overflow or Wraparound","description":"The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/190.html"}],"affected":[{"vendor":"debian","product":"cpio","name":"cpio","label":"cpio","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/cpio","purlType":"deb","versions":[{"text":"< 2.13+dfsg-5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.13+dfsg-5","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"cpio","name":"cpio","label":"cpio","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/cpio","purlType":"deb","versions":[{"text":"< 2.12+dfsg-6ubuntu0.18.04.4","noFixRecorded":false,"fixedIn":null},{"text":"< 2.13+dfsg-2ubuntu0.3","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11+dfsg-5ubuntu1.1+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11+dfsg-1ubuntu1.2+esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 2.13+dfsg-4ubuntu4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12+dfsg-6ubuntu0.18.04.4 | < 2.13+dfsg-2ubuntu0.3 | < 2.11+dfsg-5ubuntu1.1+esm1 | < 2.11+dfsg-1ubuntu1.2+esm2 | < 2.13+dfsg-4ubuntu4","eol":null,"hubHref":null},{"vendor":"gnu","product":"cpio","name":"cpio","label":"cpio","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.13","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.13","eol":null,"hubHref":"/vendor/gnu/cpio"},{"vendor":"mageia","product":"cpio","name":"cpio","label":"cpio","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/cpio","purlType":"rpm","versions":[{"text":"< 2.13-5.1.mga8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.13-5.1.mga8","eol":null,"hubHref":null},{"vendor":"redhat","product":"cpio","name":"cpio","label":"cpio","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/cpio","purlType":"rpm","versions":[{"text":"< 0:2.12-11.el8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.12-11.el8","eol":null,"hubHref":null},{"vendor":"redhat","product":"cpio-debuginfo","name":"cpio-debuginfo","label":"cpio-debuginfo","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/cpio-debuginfo","purlType":"rpm","versions":[{"text":"< 0:2.12-11.el8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.12-11.el8","eol":null,"hubHref":null},{"vendor":"redhat","product":"cpio-debugsource","name":"cpio-debugsource","label":"cpio-debugsource","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/cpio-debugsource","purlType":"rpm","versions":[{"text":"< 0:2.12-11.el8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.12-11.el8","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=HPE Helion OpenStack 8","name":"cpio","label":"cpio&distro=HPE Helion OpenStack 8","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=HPE Helion OpenStack 8","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Enterprise Storage 6","name":"cpio","label":"cpio&distro=SUSE Enterprise Storage 6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Enterprise Storage 6","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Micro 5.0","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Micro 5.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Micro 5.0","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Point of Sale 11 SP3","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Point of Sale 11 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Point of Sale 11 SP3","purlType":"rpm","versions":[{"text":"< 2.9-75.81.8.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.9-75.81.14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9-75.81.8.1 | < 2.9-75.81.14.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server 11 SP4-LTSS","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server 11 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server 11 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 2.9-75.81.8.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.9-75.81.14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9-75.81.8.1 | < 2.9-75.81.14.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server 12 SP2-BCL","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server 12 SP2-BCL","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server 12 SP2-BCL","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server 12 SP3-BCL","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server 12 SP3-BCL","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server 12 SP3-BCL","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server 12 SP3-LTSS","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server 12 SP3-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server 12 SP3-LTSS","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server 12 SP4-LTSS","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server 12 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server 12 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server 12 SP5","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server 12 SP5","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server 15 SP1-BCL","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server 15 SP1-BCL","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server 15 SP1-BCL","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server 15 SP1-LTSS","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server 15 SP1-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server 15 SP1-LTSS","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server 15-LTSS","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server 15-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server 15-LTSS","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server for SAP Applications 15","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server for SAP Applications 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server for SAP Applications 15","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1","name":"cpio","label":"cpio&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Manager Proxy 4.0","name":"cpio","label":"cpio&distro=SUSE Manager Proxy 4.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Manager Proxy 4.0","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Manager Retail Branch Server 4.0","name":"cpio","label":"cpio&distro=SUSE Manager Retail Branch Server 4.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Manager Retail Branch Server 4.0","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE Manager Server 4.0","name":"cpio","label":"cpio&distro=SUSE Manager Server 4.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE Manager Server 4.0","purlType":"rpm","versions":[{"text":"< 2.12-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE OpenStack Cloud 8","name":"cpio","label":"cpio&distro=SUSE OpenStack Cloud 8","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE OpenStack Cloud 8","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE OpenStack Cloud 9","name":"cpio","label":"cpio&distro=SUSE OpenStack Cloud 9","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE OpenStack Cloud 9","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE OpenStack Cloud Crowbar 8","name":"cpio","label":"cpio&distro=SUSE OpenStack Cloud Crowbar 8","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE OpenStack Cloud Crowbar 8","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"cpio&distro=SUSE OpenStack Cloud Crowbar 9","name":"cpio","label":"cpio&distro=SUSE OpenStack Cloud Crowbar 9","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/cpio&distro=SUSE OpenStack Cloud Crowbar 9","purlType":"rpm","versions":[{"text":"< 2.11-36.12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.9.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.11-36.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11-36.12.1 | < 2.11-36.9.1 | < 2.11-36.15.1","eol":null,"hubHref":null}],"affectedCount":38,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/fangqyi/cpiopwn","label":"github.com/fangqyi/cpiopwn","hostname":"github.com","tags":["REPORT","Exploit","Third Party Advisory"]},{"url":"https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00000.html","label":"lists.gnu.org/archive/html/bug-cpio/2021-08/msg00000.html","hostname":"lists.gnu.org","tags":["REPORT","Exploit","Mailing List","Vendor Advisory"]},{"url":"https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00002.html","label":"lists.gnu.org/archive/html/bug-cpio/2021-08/msg00002.html","hostname":"lists.gnu.org","tags":["REPORT","Exploit","Mailing List","Vendor Advisory"]},{"url":"https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=dd96882877721703e19272fe25034560b794061b","label":"git.savannah.gnu.org/cgit/cpio.git/commit/?id=dd96882877721703e19272fe25034560b794061b","hostname":"git.savannah.gnu.org","tags":["Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00007.html","label":"lists.debian.org/debian-lts-announce/2023/06/msg00007.html","hostname":"lists.debian.org","tags":["Mailing List"]},{"url":"https://advisories.mageia.org/MGASA-2021-0423.html","label":"advisories.mageia.org/MGASA-2021-0423.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29366","label":"bugs.mageia.org/show_bug.cgi?id=29366","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-August/009282.html","label":"lists.suse.com/pipermail/sle-security-updates/2021-August/009282.html","hostname":"lists.suse.com","tags":["WEB"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XORUFH2I27QQWZXGSRUKWLXW5NX5KLXA/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["WEB"]},{"url":"https://ubuntu.com/security/notices/USN-5064-1","label":"ubuntu.com/security/notices/USN-5064-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2021-2779/suse-ru-20212779-1/","label":"www.suse.com/support/update/announcement/-2021-2779/suse-ru-20212779-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1189465","label":"bugzilla.suse.com/1189465","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38185","label":"www.suse.com/security/cve/CVE-2021-38185","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/-2021-2780/suse-ru-20212780-1/","label":"www.suse.com/support/update/announcement/-2021-2780/suse-ru-20212780-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114777-1/","label":"www.suse.com/support/update/announcement/2021/suse-su-202114777-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1189206","label":"bugzilla.suse.com/1189206","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114788-1/","label":"www.suse.com/support/update/announcement/2021/suse-su-202114788-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212686-1/","label":"www.suse.com/support/update/announcement/2021/suse-su-20212686-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212808-1/","label":"www.suse.com/support/update/announcement/2021/suse-su-20212808-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1991","label":"access.redhat.com/errata/RHSA-2022:1991","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","label":"access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991731","label":"bugzilla.redhat.com/show_bug.cgi?id=1991731","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1991.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1991.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-38185","label":"access.redhat.com/security/cve/CVE-2021-38185","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38185","label":"www.cve.org/CVERecord?id=CVE-2021-38185","hostname":"www.cve.org","tags":["Advisory","REPORT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38185","label":"nvd.nist.gov/vuln/detail/CVE-2021-38185","hostname":"nvd.nist.gov","tags":["Advisory","Oval"]},{"url":"https://ubuntu.com/security/CVE-2021-38185","label":"ubuntu.com/security/CVE-2021-38185","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-5064-2","label":"ubuntu.com/security/notices/USN-5064-2","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5064-3","label":"ubuntu.com/security/notices/USN-5064-3","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-38185","label":"security-tracker.debian.org/tracker/CVE-2021-38185","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["DLA-3445-1","OPENSUSE-SU-2024:10697-1"],"duplicates":[],"related":["OPENSUSE-SU-2024:10697-1"]},"timeline":[{"kind":"published","date":"2021-08-07T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-06-09T15:11:29.808Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":42,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T13:38:38.329Z","stale":false,"partial":false}}