ALPINE-CVE-2023-49298

    Dashboard / Vulnerabilities / ALPINE-CVE-2023-49298

    ALPINE-CVE-2023-49298

    Published: 24 Nov 2023Last Modified: 15 Sept 2026
    Upstream:
    CVE-2023-49298

    Summary:

    Details: OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.

    References: https://security.alpinelinux.org/vuln/CVE-2023-49298

    Affected packages

    Package

    Name: zfs

    Purl: pkg:apk/alpine/zfs?arch=source

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.2.1-r1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    ALPINE-CVE-2023-49298 | CVE-DB