Stay Secure with the Latest Linux Advisories

security advisorymoderateupdate

Red Hat Enterprise Linux 8.2 RHSA-2022:0073-01 Moderate Cpio Update

An update for cpio is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: cpio security update Advisory ID: RHSA-2022:0073-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:0073 Issue date: 2022-01-11 CVE Names: CVE-2019-14866 ==================================================================== 1. Summary: An update for cpio is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS EUS (v. 8.2) - aarch64, ppc64le, s390x, x86_64 3. Description: The cpio packages provide the GNU cpio utility for creating and extracting archives, or copying files from one place to another. Security Fix(es): * cpio: improper input validation when writing tar header fields leads to unexpected tar generation (CVE-2019-14866) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1765511 - CVE-2019-14866 cpio: improper input validation when writing tar header fields leads to unexpected targeneration 6. Package List: Red Hat Enterprise Linux BaseOS EUS (v. 8.2): Source: cpio-2.12-8.el8_2.1.src.rpm aarch64: cpio-2.12-8.el8_2.1.aarch64.rpm cpio-debuginfo-2.12-8.el8_2.1.aarch64.rpm cpio-debugsource-2.12-8.el8_2.1.aarch64.rpm ppc64le: cpio-2.12-8.el8_2.1.ppc64le.rpm cpio-debuginfo-2.12-8.el8_2.1.ppc64le.rpm cpio-debugsource-2.12-8.el8_2.1.ppc64le.rpm s390x: cpio-2.12-8.el8_2.1.s390x.rpm cpio-debuginfo-2.12-8.el8_2.1.s390x.rpm cpio-debugsource-2.12-8.el8_2.1.s390x.rpm x86_64: cpio-2.12-8.el8_2.1.x86_64.rpm cpio-debuginfo-2.12-8.el8_2.1.x86_64.rpm cpio-debugsource-2.12-8.el8_2.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-14866 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYd37htzjgjWX9erEAQhnLRAAlbejlFiwN+/JIJ2kIlz5L6ViICMe2dmQ G7AAfU4Bfyw1TjnUCNfjn6mAN8tl/TSPylUUl7QD2wIzf+2n/i0sknnZwF8nI/rb lw7kWsh8zKat77QYysSGQJKk/oUQRhwpInHmzjGF6ckba3sK7QE1oiUhSAkTl2c/ /re7VLcqmrXefctngW1SJuMv+Q177Ti+QQmK4BdYJLK6Md99p7Wvn7IcANLKypMZ RYH9XfYEKDuGny4p3d8z+1DcbRA3bISIrePBctWxeWd0+QbN9Gd+JhzjXyOM7h+t q0FPrRGV0SLtx5Zy2cXQA+87QwULX0N18721mTRblSrQCzzL6o7p0c+pbDX7LHsc MYeoAYyXtc3XLx5f0N4jwLqdCUk7Gub8DBFoAJpo/q2EqWEubCKJaalfuBUwG/Sx y0YusmeBxBzfdEj87ac0oG4YTHNtumEQ9Ld5oN9vAnVghxiUzRziN+4Fmd6MJZpV FUa/UXaLH1sUHaG/w1orBx0xQUXiye4iG70q38hK6ipYx3XfxJIuHY+slxYfZVGI 129csM71ov10v+RKyxvVvxrvsQI/9nuB9qAKSzyKglNAzf8w9EHQp/bLQ21WKISp hvyn2qA8dpWgkS7GMnRA42il86/p4ChhGhHyaIBwOsXvQFfNNvURNjG48e+LV6pa MXoyjqc1+S4=sr3d -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Red Hat has released a security patch for cpio in RHEL 8.2 EUS addressing input validationvulnerabilities related to tar header parameters.. RHEL 8.2 EUS, cpio update, Red Hat security, input validation issue. . Severity: Important. LinuxSecurity.com Team

Jan 11, 2022 •Important Red Hat