Skip to content
Fencer Intel
medium 6.7

CVE-2019-14866 json

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.

published 6y ago modified 4mo ago also EUVD-2019-5982

cvss
6.7
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.

Patch / fix

  • gnu cpio 2.13
  • cpio Debian 14, Debian 13, Debian 12 2.13+dfsg-1

debian advisories DEBIAN-CVE-2019-14866

  • cpio Ubuntu 16.04 LTS 2.11+dfsg-5ubuntu1.1
  • cpio Ubuntu 18.04 LTS 2.12+dfsg-6ubuntu0.18.04.1
  • cpio Ubuntu Pro 14.04 LTS 2.11+dfsg-1ubuntu1.2+esm1

ubuntu advisories UBUNTU-CVE-2019-14866

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cpio RHEL 8 2.12-10.el8
  • cpio RHEL 7 2.11-28.el7
  • cpio RHEL 8.2 EUS 2.12-8.el8_2.1

red hat advisories RHSA-2022:0073RHSA-2021:1582RHSA-2020:3908

  • cpio SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +2 more 2.11-36.6.1
  • cpio SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 2.12-3.3.1

suse advisories SUSE-SU-2019:3064-1SUSE-SU-2019:3059-1

  • cpio openSUSE Tumbleweed 2.13-3.3
  • cpio openSUSE Leap 15.1 2.12-lp151.3.3.1
  • cpio openSUSE Leap 15.0 2.12-lp150.2.3.1

opensuse advisories openSUSE-SU-2024:10697-1openSUSE-SU-2019:2596-1openSUSE-SU-2019:2593-1

  • cpio Rocky Linux 8 2.12-10.el8

rocky linux advisories RLSA-2021:1582

  • cpio Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 2.13-r0

alpine advisories ALPINE-CVE-2019-14866

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2019-14866 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-14866 updated cvss 6.7

cpio: improper input validation when writing tar header fields leads to unexpected tar generation

  • Red Hat Enterprise Linux 5 cpio Red Hat Enterprise Linux 6 cpio
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Do 1 openshiftdo/odo-init-image-rhel7 1.1.3-2
    fixed: vendor fix RHSA-2021:0949
  • Red Hat Enterprise Linux BaseOS (v. 8) cpio 2.12-10.el8
    fixed: vendor fix RHSA-2021:1582
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) cpio 2.12-8.el8_2.1
    fixed: vendor fix RHSA-2022:0073
  • Red Hat Enterprise Linux Client (v. 7) cpio 2.11-28.el7 Red Hat Enterprise Linux ComputeNode (v. 7) cpio 2.11-28.el7 Red Hat Enterprise Linux Server (v. 7) cpio 2.11-28.el7 Red Hat Enterprise Linux Workstation (v. 7) cpio 2.11-28.el7
    fixed: vendor fix RHSA-2020:3908

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.69% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14866 referenced PoC, tagged "exploit" by a source, unverified
  • lists.gnu.org https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • Red Hat cpio

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.