cpio-2.12-11.el8.ML.1

エラータID: AXSA:2022-3303:02

Release date: 
Thursday, June 30, 2022 - 07:37
Subject: 
cpio-2.12-11.el8.ML.1
Affected Channels: 
Asianux Server 8 for x86_64
Severity: 
Moderate
Description: 

GNU cpio copies files into or out of a cpio or tar archive. Archives
are files which contain a collection of other files plus information
about them, such as their file name, owner, timestamps, and access
permissions. The archive can be another file on the disk, a magnetic
tape, or a pipe. GNU cpio supports the following archive formats: binary,
old ASCII, new ASCII, crc, HPUX binary, HPUX old ASCII, old tar and POSIX.1
tar. By default, cpio creates binary format archives, so that they are
compatible with older cpio programs. When it is extracting files from
archives, cpio automatically recognizes which kind of archive it is reading
and can read archives created on machines with a different byte-order.

Install cpio if you need a program to manage file archives.

Security Fix(es):

Update the version to 2.12-11.el8.ML.1.

Solution: 

Update packages.

CVEs: 
CVE-2021-38185
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.
Additional Info: 

N/A

Download: 

SRPMS
  1. cpio-2.12-11.el8.ML.1.src.rpm
    MD5: de9389bb5fc4f1b5dac25e485b8623db
    SHA-256: 008a2acaf96411eeccf997b00f7b2d140fb9dbca02bb7e537f89f77082517cb8
    Size: 1.25 MB

Asianux Server 8 for x86_64
  1. cpio-2.12-11.el8.ML.1.x86_64.rpm
    MD5: 608e7f608227a8ec28e77b3883d7171b
    SHA-256: 2897a269ada53ef620f190212860811cc81a1b35a0b7f80424c79f0040648c67
    Size: 264.72 kB