Skip to content
OpenAdvisories
Medium ALAS2-2023-2374 1 CVE

Moderate: libarchive security update (Amazon Linux 2)

Published Nov 29, 2023 · Updated Dec 4, 2023

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-31566: An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 bsdcpio 0:3.1.2-14.amzn2.0.3
Amazon Linux · 2 bsdtar 0:3.1.2-14.amzn2.0.3
Amazon Linux · 2 libarchive 0:3.1.2-14.amzn2.0.3
Amazon Linux · 2 libarchive-debuginfo 0:3.1.2-14.amzn2.0.3
Amazon Linux · 2 libarchive-devel 0:3.1.2-14.amzn2.0.3

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-31566.html