Re: Still not fixed CVE-2015-1197?

[Lukas Javorsky]

Thanks for the reply,

I can see you are planning to release cpio-2.14 from the commits, do you have any estimate of when it could be released as stable?

On Fri, Apr 28, 2023 at 10:41 AM Sergey Poznyakoff <gray@gnu.org.ua> wrote:

Hi Lukas,

Apologies for the late reply.

> I was looking at the CVE-2015-1197 reported for cpio and it is still
> not fixed.
>
> The fix was recommended to be reverted [1] due to shutdown errors that
> it caused.
> Do you have any updates on this?

I have pushed the following fix:

http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628

Regards,
Sergey

--

S pozdravom/ Best regards

Lukáš Javorský

Software Engineer, Core service - Databases

Red Hat

Purkyňova 115 (TPB-C)

612 00 Brno - Královo Pole

ljavorsk@redhat.com