CVE-2019-1000020: Medium severity Libarchive libarchive vulnerability
CVE-2019-1000020 libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archivereadsupportformatiso9660.c, readCE()/parserockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file. CVE-2019-1000019 libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archivereadsupportformat7zip.c, headerbytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.
Other sources
libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archivereadsupportformatiso9660.c, readCE()/parserockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.
References: https://github.com/libarchive/libarchive/pull/1120/commits/8312eaa576014cd9b965012af51bc1f967b12423 https://github.com/libarchive/libarchive/pull/1120
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-1000020?
CVE-2019-1000020 is a vulnerability in libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) that can result in denial of service (DoS).
How severe is CVE-2019-1000020?
CVE-2019-1000020 has a severity score of 6.5 (Medium).
What is the affected software for CVE-2019-1000020?
The affected software includes libarchive versions 3.1.2-7ubuntu2.8, 3.1.2-11ubuntu0.16.04.6, 3.2.2-3.1ubuntu0.3, 3.2.2-5ubuntu0.2, 3.3.3-4+deb10u1, 3.3.3-4+deb10u3, 3.4.3-2+deb11u1, 3.6.2-1, and 3.7.2-1, as well as Ubuntu, Debian, Fedora, Redhat, openSUSE Leap, and Canonical Ubuntu Linux.
How can CVE-2019-1000020 be fixed?
To fix CVE-2019-1000020, update libarchive to a version where the vulnerability has been patched, such as versions 3.1.2-7ubuntu2.8, 3.1.2-11ubuntu0.16.04.6, 3.2.2-3.1ubuntu0.3, 3.2.2-5ubuntu0.2, 3.3.3-4+deb10u1, 3.3.3-4+deb10u3, 3.4.3-2+deb11u1, 3.6.2-1, or 3.7.2-1.
Where can I find more information about CVE-2019-1000020?
You can find more information about CVE-2019-1000020 at the following references: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html, http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html, http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html.