Vulnerability · Published Aug 23, 2022 · Assigned by redhat
CVE-2021-31566
High 7.8
In plain English
A high-severity security flaw in libarchive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.4%top 66.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bsdtar | 3.3.3-3.el8_5 | ALSA-2022:0892 |
| AlmaLinux:8 | libarchive | 3.3.3-3.el8_5 | ALSA-2022:0892 |
| AlmaLinux:8 | libarchive-devel | 3.3.3-3.el8_5 | ALSA-2022:0892 |
| Debian:12 | libarchive | 3.5.2-1 | DEBIAN-CVE-2021-31566 |
| Debian:13 | libarchive | 3.5.2-1 | DEBIAN-CVE-2021-31566 |
| Debian:14 | libarchive | 3.5.2-1 | DEBIAN-CVE-2021-31566 |
| Rocky Linux:8 | libarchive | 0:3.3.3-3.el8_5 | RLSA-2022:0892 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | libarchive | Fixed in libarchive 3.5.2 |
Weakness: CWE-59
References
- https://github.com/libarchive/libarchive/issues/1566
- https://github.com/libarchive/libarchive/commit/b41daecb5ccb4c8e3b2c53fd6147109fc12c3043
- https://bugzilla.redhat.com/show_bug.cgi?id=2024237
- https://access.redhat.com/security/cve/CVE-2021-31566
- [debian-lts-announce] 20221122 [SECURITY] [DLA 3202-1] libarchive security update mailing-list