PT-2023-9341 · Debian+6 · Cpio+7

Ingo Brückl · Published 2023-04-27 · Updated 2025-08-26 · CVE-2023-7207

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions cpio (affected versions not specified)

Description The issue is related to a path traversal vulnerability in Debian's cpio, which was introduced by reverting patches for a previous issue. This vulnerability is associated with a regression when using the --no-absolute-filenames parameter. The exploitation of this issue could allow a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2025-5537

ALT-PU-2025-5539

BDU:2024-06679

CVE-2023-7207

OPENSUSE-SU-2024:13653-1

OPENSUSE-SU-2024_0238-1

SUSE-SU-2024:0238-1

SUSE-SU-2024:0248-1

SUSE-SU-2024:0305-1

SUSE-SU-2024:0305-2

SUSE-SU-2024:0305-3

SUSE-SU-2024:0824-1

SUSE-SU-2024:0825-1

SUSE-SU-2024_0238-1

SUSE-SU-2024_0248-1

SUSE-SU-2024_0305-2

SUSE-SU-2024_0824-1

USN-6755-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Red Os

Suse

Ubuntu

Cpio

References · 39

• https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:0824-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-7207 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06679 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-7207 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7207 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13653-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0305-2 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0305-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6755-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-7207 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-7207 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-7207 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0825-1 · Vendor Advisory