{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos7els/vex/2026/cve-2026-66484-els_os-centos7els.json" } ], "tracking": { "current_release_date": "2026-08-14T14:43:24Z", "generator": { "date": "2026-08-14T14:43:24Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-66484-ELS_OS-CENTOS7ELS", "initial_release_date": "2026-08-10T11:17:00Z", "revision_history": [ { "date": "2026-08-10T11:17:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-08-13T12:45:23Z", "number": "2", "summary": "Official Publication" }, { "date": "2026-08-14T14:43:24Z", "number": "3", "summary": "Update document" } ], "status": "final", "version": "3" }, "title": "Security update on CVE-2026-66484" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 7", "product": { "name": "Community Enterprise Operating System 7", "product_id": "CentOS-7", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" }, { "branches": [ { "category": "product_version", "name": "cpio-0:2.11-28.el7.x86_64", "product": { "name": "cpio-0:2.11-28.el7.x86_64", "product_id": "cpio-0:2.11-28.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/cpio@2.11-28.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "cpio-0:2.11-28.el7.tuxcare.els1.x86_64", "product": { "name": "cpio-0:2.11-28.el7.tuxcare.els1.x86_64", "product_id": "cpio-0:2.11-28.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/cpio@2.11-28.el7.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "cpio-0:2.11-28.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:cpio-0:2.11-28.el7.tuxcare.els1.x86_64" }, "product_reference": "cpio-0:2.11-28.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "cpio-0:2.11-28.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:cpio-0:2.11-28.el7.x86_64" }, "product_reference": "cpio-0:2.11-28.el7.x86_64", "relates_to_product_reference": "CentOS-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-66484", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "description", "text": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.\n\nThis issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad", "title": "Vulnerability description" } ], "product_status": { "known_affected": [ "CentOS-7:cpio-0:2.11-28.el7.tuxcare.els1.x86_64", "CentOS-7:cpio-0:2.11-28.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-66484" }, { "category": "external", "summary": "https://cert.pl/en/posts/2026/08/CVE-2026-66484", "url": "https://cert.pl/en/posts/2026/08/CVE-2026-66484" }, { "category": "external", "summary": "https://git.savannah.gnu.org/cgit/cpio.git", "url": "https://git.savannah.gnu.org/cgit/cpio.git" } ], "release_date": "2026-08-10T11:17:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-08-14T10:44:14.793129Z", "details": "Deprioritize: Exploitation requires an operator to manually extract an attacker‑supplied tar/ustar archive with cpio in copy‑in mode and specifically pass the --no-absolute-filenames flag; there is no network‑reachable service surface. The flaw only creates a hard link to an already‑existing file outside the extraction directory (no arbitrary file creation or execution), and it succeeds only when that external target resides on the same filesystem as the extraction root (hard links cannot cross filesystems). With user interaction required and only low confidentiality/integrity impact absent additional follow‑on actions, the practical risk to centrally managed server/VM workloads is low.", "product_ids": [ "CentOS-7:cpio-0:2.11-28.el7.tuxcare.els1.x86_64", "CentOS-7:cpio-0:2.11-28.el7.x86_64" ] } ] } ] }