Medium ELSA-2022-0892 2 CVEs

Moderate: libarchive security update (Oracle Linux 8)

Published Mar 16, 2022 · Updated Mar 16, 2022

Ecosystem: Oracle Linux

Summary

[3.3.3-3]
- Do not follow symlinks when processing the fixup list (CVE-2021-31566)

[3.3.3-2]
- Fix handling of symbolic link ACLs (CVE-2021-23177)

Fixed packages 3

Release	Package	Fixed in
Oracle Linux · 8	bsdtar	0:3.3.3-3.el8_5
Oracle Linux · 8	libarchive	0:3.3.3-3.el8_5
Oracle Linux · 8	libarchive-devel	0:3.3.3-3.el8_5

Vulnerabilities 2

Unscored —

CVE-2021-23177

An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the …

libarchive libarchive Debian Ubuntu

Aug 23, 2022
Unscored —

CVE-2021-31566

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control…

libarchive libarchive libarchive Debian Ubuntu Alpine

Aug 23, 2022