Red Hat Security Advisory

RHSA-2022:0892

libarchive security update

Released 2022-03-15 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 8) libarchive-devel-3.3.3-3.el8_5
Red Hat Enterprise Linux BaseOS (v. 8) bsdtar-3.3.3-3.el8_5, libarchive-3.3.3-3.el8_5

Fixes 2 records

TI-2021-11678 CVE-2021-31566 · GHSA-mg62-fpgc-6hjj

Link following in libarchive

LOW 34

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.0039 Published 2022-08-23 Partial fix CWE-59

TI-2021-05953 CVE-2021-23177 · GHSA-fq9q-7wp8-gpr7

Link following in libarchive

LOW 34

An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00392 Published 2022-08-23 Partial fix CWE-59