Vulnerability · Published Feb 20, 2020 · Assigned by mitre
CVE-2020-9308
High 8.8
In plain English
A high-severity security flaw in the libarchive package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)2.3%top 17.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | libarchive | 3.4.2-r0 | ALPINE-CVE-2020-9308 |
| Alpine:v3.21 | libarchive | 3.4.2-r0 | ALPINE-CVE-2020-9308 |
| Alpine:v3.22 | libarchive | 3.4.2-r0 | ALPINE-CVE-2020-9308 |
| Alpine:v3.23 | libarchive | 3.4.2-r0 | ALPINE-CVE-2020-9308 |
| Alpine:v3.24 | libarchive | 3.4.2-r0 | ALPINE-CVE-2020-9308 |
| Debian:12 | libarchive | 3.4.0-2 | DEBIAN-CVE-2020-9308 |
| Debian:13 | libarchive | 3.4.0-2 | DEBIAN-CVE-2020-9308 |
| Debian:14 | libarchive | 3.4.0-2 | DEBIAN-CVE-2020-9308 |
Affected products (as reported)
References
- https://github.com/libarchive/libarchive/pull/1326 x_refsource_MISC
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20459 x_refsource_MISC
- https://github.com/libarchive/libarchive/pull/1326/commits/94821008d6eea81e315c5881cdf739202961040a x_refsource_MISC
- GLSA-202003-28 vendor-advisory, x_refsource_GENTOO
- USN-4293-1 vendor-advisory, x_refsource_UBUNTU
- FEDORA-2020-94211d0a7d vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-d8278fe24d vendor-advisory, x_refsource_FEDORA