CVE-2019-14866

En todas las versiones de cpio anteriores a la versión 2.13, no comprueba apropiadamente los archivos de entrada cuando se generan archivos TAR. Cuando cpio es usado para crear archivos TAR desde rutas en las que un atacante puede escribir, el archivo resultante puede contener archivos con permisos que el atacante no tenía o en rutas a las que no tenía acceso. Al extraer esos archivos desde un usuario con altos privilegios sin revisarlos cuidadosamente puede conllevar al compromiso del sistema.

It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.

Red Hat Advanced Cluster Management for Kubernetes 2.2.4 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs and security issues. Issues addressed include denial of service and integer overflow vulnerabilities.