First published: Wed Nov 17 2021(Updated: )
An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.
Credit: secalert@redhat.com secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/libarchive | <3.5.2 | 3.5.2 |
Libarchive Libarchive | <3.5.2 | |
Fedoraproject Fedora | =35 | |
Redhat Enterprise Linux | =8.0 | |
Redhat Enterprise Linux Eus | =8.6 | |
Redhat Enterprise Linux For Ibm Z Systems | =8.0 | |
Redhat Enterprise Linux For Ibm Z Systems Eus | =8.6 | |
Redhat Enterprise Linux For Power Little Endian | =8.0 | |
Redhat Enterprise Linux For Power Little Endian Eus | =8.6 | |
Redhat Enterprise Linux Server Aus | =8.6 | |
Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions | =8.6 | |
Redhat Enterprise Linux Server Tus | =8.6 | |
Redhat Codeready Linux Builder | ||
Redhat Enterprise Linux | =8.0 | |
Redhat Enterprise Linux Eus | =8.6 | |
Redhat Enterprise Linux For Ibm Z Systems | =8.0 | |
Redhat Enterprise Linux For Ibm Z Systems Eus | =8.6 | |
Redhat Enterprise Linux For Power Little Endian | =8.0 | |
Redhat Enterprise Linux For Power Little Endian Eus | =8.6 | |
Debian Debian Linux | =10.0 | |
All of | ||
Redhat Codeready Linux Builder | ||
Any of | ||
Redhat Enterprise Linux | =8.0 | |
Redhat Enterprise Linux Eus | =8.6 | |
Redhat Enterprise Linux For Ibm Z Systems | =8.0 | |
Redhat Enterprise Linux For Ibm Z Systems Eus | =8.6 | |
Redhat Enterprise Linux For Power Little Endian | =8.0 | |
Redhat Enterprise Linux For Power Little Endian Eus | =8.6 | |
Splunk Universal Forwarder | >=8.2.0<8.2.12 | |
Splunk Universal Forwarder | >=9.0.0<9.0.6 | |
Splunk Universal Forwarder | =9.1.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2021-31566 is a vulnerability in the Libarchive library that allows an attacker to change the modes, times, access control lists, and flags of a file outside of an archive when it is extracted.
CVE-2021-31566 occurs due to an improper link resolution flaw in the Libarchive library.
CVE-2021-31566 has a severity rating of high, with a CVSS score of 7.8.
The Libarchive library version up to exclusive 3.5.2, Fedora 35, and various versions of Redhat Enterprise Linux are affected by CVE-2021-31566.
To fix CVE-2021-31566, update the Libarchive library to version 3.5.2 or later.