{"id":"CLSA-2026-1777368104","summary":"Fix CVE(s): CVE-2023-39810","details":"   * SECURITY UPDATE: directory traversal in cpio extraction\n     - debian/patches/CVE-2023-39810.patch: add FEATURE_PATH_TRAVERSAL_PROTECTION\n       config option, call strip_unsafe_prefix() in data_extract_all.c to prevent\n       path traversal via ../ in archive filenames. Covers cpio, ar, rpm.\n     - Enable CONFIG_FEATURE_PATH_TRAVERSAL_PROTECTION=y in all build configs.\n     - debian/patches/CVE-2023-39810.patch: replace `echo -e` with `printf` in\n       the new cpio path-traversal testcase so it is portable to dash (the\n       Ubuntu /bin/sh).\n     - debian/testsuite-linux.diff: skip the pre-existing\n       \"cpio uses by default uid/gid\" test, which is fragile in the pbuilder\n       chroot (id -u returns 0 but source files retain uid=1000 from the\n       build worker, causing a spurious mismatch).\n     - debian/patches/CVE-2023-39810.patch: include the \"1 blocks\" summary\n       line that busybox cpio -vi emits (to stderr, merged via 2\u003e&1) at\n       end-of-archive in the expected output of the new path-traversal\n       testcase; the functional check (file not written, exit 0) already\n       passed but the string-match failed because 1.30.1 always prints\n       \"N blocks\", matching the pattern used by other cpio tests in\n       testsuite/cpio.tests.\n     - debian/testsuite-linux.diff: skip the pre-existing hostname-d-works\n       test when the pbuilder chroot cannot resolve its own hostname via DNS\n       (no /etc/hosts entry for the build host).\n     - CVE-2023-39810","modified":"2026-06-04T09:47:38.187958542Z","published":"2026-04-28T09:21:49Z","upstream":["CVE-2023-39810"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1777368104.html"}],"affected":[{"package":{"name":"busybox","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/busybox?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777368104.json"}},{"package":{"name":"busybox-initramfs","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/busybox-initramfs?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777368104.json"}},{"package":{"name":"busybox-static","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/busybox-static?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777368104.json"}},{"package":{"name":"busybox-syslogd","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/busybox-syslogd?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777368104.json"}},{"package":{"name":"udhcpc","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/udhcpc?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777368104.json"}},{"package":{"name":"udhcpd","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/udhcpd?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777368104.json"}}],"schema_version":"1.7.5"}