CVE-2023-49298

Description

OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.

How to fix CVE-2023-49298

To remediate CVE-2023-49298, upgrade the affected package to a fixed version below.

• —upgrade to 2.2.1-r1 or later
• —upgrade to 2.2.1-r1 or later
• —upgrade to 2.2.1-r1 or later
• —upgrade to 2.0.3-9+deb11u2 or later

Is CVE-2023-49298 being exploited?

Low — EPSS is 0.7%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 2.2.1-r1
• from 0, < 2.2.1-r1
• from 0, < 2.2.1-r1
• from 0, < 2.0.3-9+deb11u2

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2023-49298
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-49298