CVE-2019-10220 - kernel: CIFS: Relative paths injection in directory entry lists

HIGH

kernel: CIFS: Relative paths injection in directory entry lists

Published Nov 27, 2019

8.8

HIGH

CVSS 3.1

EPSS 5.12%

Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
kernel version 4.9.0	affected	-

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-alt	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise MRG 2	kernel-rt	Under investigation	n/a

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-10220		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1741727		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10220		x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2233		Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10220
https://security.netapp.com/advisory/ntap-20200103-0001/		x_refsource_CONFIRMThird Party Advisory
https://usn.ubuntu.com/4226-1/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-10220