Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - cpio: path traversal vulnerability (CVE-2023-7207)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cpio: directory traversal through symlinks (CVE-2015-1197)

  - cpio: path traversal vulnerability (CVE-2023-7207)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0305-2 advisory.

  - Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting     CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since     provided a proper fix to --no-absolute-filenames. (CVE-2023-7207)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6755-1 advisory.

  - Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting     CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since     provided a proper fix to --no-absolute-filenames. (CVE-2023-7207)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0825-1 advisory.

  - Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting     CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since     provided a proper fix to --no-absolute-filenames. (CVE-2023-7207)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0824-1 advisory.

  - Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting     CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since     provided a proper fix to --no-absolute-filenames. (CVE-2023-7207)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0305-1 advisory.

  - Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting     CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since     provided a proper fix to --no-absolute-filenames. (CVE-2023-7207)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0238-1 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0248-1 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198697	RHEL 8 : cpio (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198662	RHEL 9 : cpio (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196945	SUSE SLES15 Security Update : cpio (SUSE-SU-2024:0305-2)	Nessus	SuSE Local Security Checks	medium
194475	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : GNU cpio vulnerabilities (USN-6755-1)	Nessus	Ubuntu Local Security Checks	medium
191775	SUSE SLES12 Security Update : cpio (SUSE-SU-2024:0825-1)	Nessus	SuSE Local Security Checks	medium
191768	SUSE SLES15 Security Update : cpio (SUSE-SU-2024:0824-1)	Nessus	SuSE Local Security Checks	medium
189933	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cpio (SUSE-SU-2024:0305-1)	Nessus	SuSE Local Security Checks	medium
189719	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cpio (SUSE-SU-2024:0238-1)	Nessus	SuSE Local Security Checks	medium
189716	SUSE SLES12 Security Update : cpio (SUSE-SU-2024:0248-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-7207

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium