{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2023/cve-2023-7207-els_os-oraclelinux6els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-28T11:35:44Z",
      "generator": {
        "date": "2026-10-28T11:35:44Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2023-7207-ELS_OS-ORACLELINUX6ELS",
      "initial_release_date": "2023-01-01T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-01-01T00:00:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-28T11:35:44Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2023-7207"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Oracle Linux 6",
                "product": {
                  "name": "Oracle Linux 6",
                  "product_id": "Oracle-Linux-6",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Oracle Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cpio-0:2.10-13.el6.i686",
                "product": {
                  "name": "cpio-0:2.10-13.el6.i686",
                  "product_id": "cpio-0:2.10-13.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/cpio@2.10-13.el6?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cpio-0:2.10-13.el6.x86_64",
                "product": {
                  "name": "cpio-0:2.10-13.el6.x86_64",
                  "product_id": "cpio-0:2.10-13.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/cpio@2.10-13.el6?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cpio-0:2.10-13.el6.tuxcare.els1.i686",
                "product": {
                  "name": "cpio-0:2.10-13.el6.tuxcare.els1.i686",
                  "product_id": "cpio-0:2.10-13.el6.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/cpio@2.10-13.el6.tuxcare.els1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
                "product": {
                  "name": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
                  "product_id": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/cpio@2.10-13.el6.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cpio-0:2.10-13.el6.tuxcare.els1.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.i686"
        },
        "product_reference": "cpio-0:2.10-13.el6.tuxcare.els1.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cpio-0:2.10-13.el6.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:cpio-0:2.10-13.el6.i686"
        },
        "product_reference": "cpio-0:2.10-13.el6.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.x86_64"
        },
        "product_reference": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cpio-0:2.10-13.el6.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:cpio-0:2.10-13.el6.x86_64"
        },
        "product_reference": "cpio-0:2.10-13.el6.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-7207",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
      },
      "notes": [
        {
          "category": "description",
          "text": "Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "Oracle-Linux-6:cpio-0:2.10-13.el6.i686",
          "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.i686",
          "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
          "Oracle-Linux-6:cpio-0:2.10-13.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2023-7207"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2024/01/05/1",
          "url": "http://www.openwall.com/lists/oss-security/2024/01/05/1"
        },
        {
          "category": "external",
          "summary": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059163",
          "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059163"
        },
        {
          "category": "external",
          "summary": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7207",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7207"
        },
        {
          "category": "external",
          "summary": "https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628",
          "url": "https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2023/12/21/8",
          "url": "https://www.openwall.com/lists/oss-security/2023/12/21/8"
        }
      ],
      "release_date": "2024-02-29T01:42:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T10:08:55.128124Z",
          "details": "Deprioritize this CVE because exploitation requires a local user to knowingly extract a malicious cpio archive (local attack, user interaction), and cpio itself presents no remote or network-facing attack surface. The impact is limited to file integrity and is naturally constrained by standard filesystem permissions—an unprivileged user running cpio can only overwrite files they already have permission to modify. Given these preconditions, the realistic exposure in managed server/VM environments is low.",
          "product_ids": [
            "Oracle-Linux-6:cpio-0:2.10-13.el6.i686",
            "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.i686",
            "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
            "Oracle-Linux-6:cpio-0:2.10-13.el6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Oracle-Linux-6:cpio-0:2.10-13.el6.i686",
            "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.i686",
            "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
            "Oracle-Linux-6:cpio-0:2.10-13.el6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}