An update for cpio is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3456 Final 1.0 1.0 2026-08-20 Initial 2026-08-20 2026-08-20 openEuler SA Tool V1.0 2026-08-20 cpio security update An update for cpio is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4 GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe. Security Fix(es): GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad(CVE-2026-66484) GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9(CVE-2026-66485) An update for cpio is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium cpio https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3456 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-66484 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-66485 https://nvd.nist.gov/vuln/detail/CVE-2026-66484 https://nvd.nist.gov/vuln/detail/CVE-2026-66485 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 cpio-2.13-9.oe2003sp4.aarch64.rpm cpio-debuginfo-2.13-9.oe2003sp4.aarch64.rpm cpio-debugsource-2.13-9.oe2003sp4.aarch64.rpm cpio-2.13-12.oe2203sp4.aarch64.rpm cpio-debuginfo-2.13-12.oe2203sp4.aarch64.rpm cpio-debugsource-2.13-12.oe2203sp4.aarch64.rpm cpio-2.14-5.oe2403sp1.aarch64.rpm cpio-debuginfo-2.14-5.oe2403sp1.aarch64.rpm cpio-debugsource-2.14-5.oe2403sp1.aarch64.rpm cpio-2.14-5.oe2403sp3.aarch64.rpm cpio-debuginfo-2.14-5.oe2403sp3.aarch64.rpm cpio-debugsource-2.14-5.oe2403sp3.aarch64.rpm cpio-2.14-5.oe2403sp4.aarch64.rpm cpio-debuginfo-2.14-5.oe2403sp4.aarch64.rpm cpio-debugsource-2.14-5.oe2403sp4.aarch64.rpm cpio-2.13-9.oe2003sp4.src.rpm cpio-2.13-12.oe2203sp4.src.rpm cpio-2.14-5.oe2403sp1.src.rpm cpio-2.14-5.oe2403sp3.src.rpm cpio-2.14-5.oe2403sp4.src.rpm cpio-2.13-9.oe2003sp4.x86_64.rpm cpio-debuginfo-2.13-9.oe2003sp4.x86_64.rpm cpio-debugsource-2.13-9.oe2003sp4.x86_64.rpm cpio-2.13-12.oe2203sp4.x86_64.rpm cpio-debuginfo-2.13-12.oe2203sp4.x86_64.rpm cpio-debugsource-2.13-12.oe2203sp4.x86_64.rpm cpio-2.14-5.oe2403sp1.x86_64.rpm cpio-debuginfo-2.14-5.oe2403sp1.x86_64.rpm cpio-debugsource-2.14-5.oe2403sp1.x86_64.rpm cpio-2.14-5.oe2403sp3.x86_64.rpm cpio-debuginfo-2.14-5.oe2403sp3.x86_64.rpm cpio-debugsource-2.14-5.oe2403sp3.x86_64.rpm cpio-2.14-5.oe2403sp4.x86_64.rpm cpio-debuginfo-2.14-5.oe2403sp4.x86_64.rpm cpio-debugsource-2.14-5.oe2403sp4.x86_64.rpm cpio-help-2.13-9.oe2003sp4.noarch.rpm cpio-help-2.13-12.oe2203sp4.noarch.rpm cpio-help-2.14-5.oe2403sp1.noarch.rpm cpio-help-2.14-5.oe2403sp3.noarch.rpm cpio-help-2.14-5.oe2403sp4.noarch.rpm GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad 2026-08-20 CVE-2026-66484 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 Medium 4.6 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N cpio security update 2026-08-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3456 GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9 2026-08-20 CVE-2026-66485 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 Medium 4.6 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N cpio security update 2026-08-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3456