CVE-2020-7667

Name of the Vulnerable Software and Affected Versions go-rpmutils/cpio version 0.1.0 and earlier

Description The CPIO extraction functionality does not sanitize the paths of the archived files for leading and non-leading .., which leads to file extraction outside of the current directory. This is due to improper path sanitization, allowing RPMs containing relative file paths to cause files to be written or overwritten outside of the target directory.

Recommendations For go-rpmutils/cpio version 0.1.0 and earlier, update to version 0.1.0 or later, as the fixing commit was applied to all affected versions which were re-released.