cpio - Debian Package Tracker

general

source: cpio (main)
version: 2.15+dfsg-2.1
maintainer: Anibal Monsalve Salazar (DMD) (LowNMU)
uploaders: Chris Lamb [DMD]
arch: any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.13+dfsg-7.1~deb11u1
oldstable: 2.13+dfsg-7.1
stable: 2.15+dfsg-2
testing: 2.15+dfsg-2.1
unstable: 2.15+dfsg-2.1

versioned links

2.13+dfsg-7.1~deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.13+dfsg-7.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.15+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.15+dfsg-2.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

cpio (27 bugs: 0, 16, 11, 0)

action needed

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

https://salsa.debian.org/api/v4/projects/lamby%2Fpkg-cpio API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2020-02-01 Last update: 2026-08-15 23:02

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2026-66484: GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad
CVE-2026-66485: GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
CVE-2026-66486: GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

Created: 2026-08-10 Last update: 2026-08-14 17:03

3 security issues in forky high

There are 3 open security issues in forky.

3 important issues:

CVE-2026-66484: GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad
CVE-2026-66485: GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
CVE-2026-66486: GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

Created: 2026-08-10 Last update: 2026-08-14 17:03

4 security issues in bullseye high

There are 4 open security issues in bullseye.

3 important issues:

CVE-2026-66484: GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad
CVE-2026-66485: GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
CVE-2026-66486: GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

1 issue postponed or untriaged:

CVE-2023-7207: (needs triaging) Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.

Created: 2026-08-10 Last update: 2026-08-14 17:03

4 security issues in bookworm high

There are 4 open security issues in bookworm.

3 important issues:

CVE-2026-66484: GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad
CVE-2026-66485: GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
CVE-2026-66486: GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

1 issue postponed or untriaged:

CVE-2023-7207: (needs triaging) Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.

Created: 2026-08-10 Last update: 2026-08-14 17:03

debian/patches: 1 patch with invalid metadata, 8 patches to forward upstream high

Among the 9 debian patches available in version 2.15+dfsg-2.1 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.
8 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-12-21 22:30

5 bugs tagged patch in the BTS normal

The BTS contains patches fixing 5 bugs, consider including or untagging them.

Created: 2026-08-15 Last update: 2026-08-22 04:48

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2025-12-22 Last update: 2025-12-22 00:31

3 low-priority security issues in trixie low

There are 3 open security issues in trixie.

3 issues left for the package maintainer to handle:

CVE-2026-66484: (needs triaging) GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad
CVE-2026-66485: (needs triaging) GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
CVE-2026-66486: (needs triaging) GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-08-10 Last update: 2026-08-14 17:03

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.0).

Created: 2025-02-21 Last update: 2026-03-31 15:01

news

[rss feed]

[2025-12-26] cpio 2.15+dfsg-2.1 MIGRATED to testing (Debian testing watch)
[2025-12-21] Accepted cpio 2.15+dfsg-2.1 (source) into unstable (Chris Hofstaedtler) (signed by: Christian Hofstaedtler)
[2024-08-02] cpio 2.15+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-07-28] Accepted cpio 2.15+dfsg-2 (source) into unstable (Anibal Monsalve Salazar)
[2024-01-20] cpio 2.15+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-01-15] Accepted cpio 2.15+dfsg-1 (source) into unstable (Anibal Monsalve Salazar)
[2023-12-27] cpio 2.14+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-12-22] Accepted cpio 2.14+dfsg-1 (source) into unstable (Anibal Monsalve Salazar)
[2023-10-01] Accepted cpio 2.13+dfsg-7.1~deb11u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Adrian Bunk)
[2023-06-04] Accepted cpio 2.12+dfsg-9+deb10u1 (source) into oldstable (Adrian Bunk)
[2022-09-23] cpio 2.13+dfsg-7.1 MIGRATED to testing (Debian testing watch)
[2022-09-17] Accepted cpio 2.13+dfsg-7.1 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2021-08-24] cpio 2.13+dfsg-7 MIGRATED to testing (Debian testing watch)
[2021-08-22] Accepted cpio 2.13+dfsg-7 (source) into unstable (Anibal Monsalve Salazar)
[2021-08-13] Accepted cpio 2.13+dfsg-6 (source) into unstable (Anibal Monsalve Salazar)
[2021-08-10] Accepted cpio 2.13+dfsg-5 (source) into unstable (Anibal Monsalve Salazar)
[2020-09-22] cpio 2.13+dfsg-4 MIGRATED to testing (Debian testing watch)
[2020-09-17] Accepted cpio 2.13+dfsg-4 (source) into unstable (Anibal Monsalve Salazar)
[2020-07-08] Accepted cpio 2.13+dfsg-3 (source all amd64) into unstable (Anibal Monsalve Salazar)
[2020-02-06] cpio 2.13+dfsg-2 MIGRATED to testing (Debian testing watch)
[2020-02-01] Accepted cpio 2.13+dfsg-2 (source) into unstable (Chris Lamb)
[2019-11-26] cpio 2.13+dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-11-20] Accepted cpio 2.13+dfsg-1 (source) into unstable (Chris Lamb)
[2019-11-05] Accepted cpio 2.11+dfsg-4.1+deb8u2 (source all amd64) into oldoldstable (Ola Lundqvist)
[2019-04-29] cpio 2.12+dfsg-9 MIGRATED to testing (Debian testing watch)
[2019-04-23] Accepted cpio 2.12+dfsg-9 (source all amd64) into unstable (Chris Lamb)
[2019-04-23] Accepted cpio 2.12+dfsg-8 (source all amd64) into unstable (Chris Lamb)
[2019-04-23] Accepted cpio 2.12+dfsg-7 (source all amd64) into unstable (Chris Lamb)
[2017-12-07] cpio 2.12+dfsg-6 MIGRATED to testing (Debian testing watch)
[2017-12-02] Accepted cpio 2.12+dfsg-6 (source all amd64) into unstable (Chris Lamb)

bugs [bug history graph]

all: 32
RC: 0
I&N: 18
M&W: 14
F&P: 0
patch: 5

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (-, 86)
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.15+dfsg-2.1