Lucene search

RedhatCVE-2021-23177

HistoryAug 23, 2022 - 4:15 p.m.

CVE-2021-23177

2022-08-2316:15:09

CWE-59

redhat

web.nvd.nist.gov

164

cve-2021-23177

improper link resolution

archive extraction

acl manipulation

access control list

security vulnerability

nvd

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

25.2%

JSON

An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.

Affected configurations

Nvd

Vulners

Node

libarchivelibarchiveRange<3.5.2

Node

fedoraprojectfedoraMatch35

Node

redhatenterprise_linuxMatch8.0

redhatenterprise_linux_eusMatch8.6

redhatenterprise_linux_for_ibm_z_systemsMatch8.0

redhatenterprise_linux_for_ibm_z_systems_eusMatch8.6

redhatenterprise_linux_for_power_little_endianMatch8.0

redhatenterprise_linux_for_power_little_endian_eusMatch8.6

redhatenterprise_linux_server_ausMatch8.6

redhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsMatch8.6

redhatenterprise_linux_server_tusMatch8.6

Node

redhatcodeready_linux_builderMatch-

AND

redhatenterprise_linuxMatch8.0

redhatenterprise_linux_eusMatch8.6

redhatenterprise_linux_for_ibm_z_systemsMatch8.0

redhatenterprise_linux_for_ibm_z_systems_eusMatch8.6

redhatenterprise_linux_for_power_little_endianMatch8.0

redhatenterprise_linux_for_power_little_endian_eusMatch8.6

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
libarchivelibarchive*cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*
fedoraprojectfedora35cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
redhatenterprise_linux8.0cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
redhatenterprise_linux_eus8.6cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
redhatenterprise_linux_for_ibm_z_systems8.0cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*
redhatenterprise_linux_for_ibm_z_systems_eus8.6cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*
redhatenterprise_linux_for_power_little_endian8.0cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*
redhatenterprise_linux_for_power_little_endian_eus8.6cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*
redhatenterprise_linux_server_aus8.6cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
redhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.6cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libarchive	libarchive	*	cpe:2.3:a:libarchive:libarchive::::::::
fedoraproject	fedora	35	cpe:2.3:o:fedoraproject:fedora:35:::::::*
redhat	enterprise_linux	8.0	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
redhat	enterprise_linux_eus	8.6	cpe:2.3:o:redhat:enterprise_linux_eus:8.6:::::::*
redhat	enterprise_linux_for_ibm_z_systems	8.0	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:::::::*
redhat	enterprise_linux_for_ibm_z_systems_eus	8.6	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:::::::*
redhat	enterprise_linux_for_power_little_endian	8.0	cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:::::::*
redhat	enterprise_linux_for_power_little_endian_eus	8.6	cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:::::::*
redhat	enterprise_linux_server_aus	8.6	cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:::::::*
redhat	enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions	8.6	cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:::::::*

Rows per page:

1-10 of 131

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "libarchive",
    "versions": [
      {
        "version": "Fixed in libarchive 3.5.2",
        "status": "affected"
      }
    ]
  }
]