CVE-2021-38185

GNU cpio versiones hasta 2.13, permite a atacantes ejecutar código arbitrario por medio de un archivo de patrones diseñado, debido a un desbordamiento de enteros en el archivo dstring.c en la función ds_fgetstr que desencadena una escritura de pila fuera de límites. NOTA: no está claro si hay casos comunes en los que el archivo de patrones, asociado con la opción -E, son datos no confiables

A flaw was found in cpio. An integer overflow that triggers an out-of-bounds heap write can allow an attacker to execute arbitrary code via a crafted pattern file. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Red Hat Advanced Cluster Management for Kubernetes 2.3.11 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which resolve security issues and fix several bugs. Issues addressed include a traversal vulnerability.