Lucene search

K
cveRedhatCVE-2021-23177
HistoryAug 23, 2022 - 4:15 p.m.

CVE-2021-23177

2022-08-2316:15:09
CWE-59
redhat
web.nvd.nist.gov
164
4
cve-2021-23177
improper link resolution
archive extraction
acl manipulation
access control list
security vulnerability
nvd

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

25.2%

An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.

Affected configurations

Nvd
Vulners
Node
libarchivelibarchiveRange<3.5.2
Node
fedoraprojectfedoraMatch35
Node
redhatenterprise_linuxMatch8.0
OR
redhatenterprise_linux_eusMatch8.6
OR
redhatenterprise_linux_for_ibm_z_systemsMatch8.0
OR
redhatenterprise_linux_for_ibm_z_systems_eusMatch8.6
OR
redhatenterprise_linux_for_power_little_endianMatch8.0
OR
redhatenterprise_linux_for_power_little_endian_eusMatch8.6
OR
redhatenterprise_linux_server_ausMatch8.6
OR
redhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsMatch8.6
OR
redhatenterprise_linux_server_tusMatch8.6
Node
redhatcodeready_linux_builderMatch-
AND
redhatenterprise_linuxMatch8.0
OR
redhatenterprise_linux_eusMatch8.6
OR
redhatenterprise_linux_for_ibm_z_systemsMatch8.0
OR
redhatenterprise_linux_for_ibm_z_systems_eusMatch8.6
OR
redhatenterprise_linux_for_power_little_endianMatch8.0
OR
redhatenterprise_linux_for_power_little_endian_eusMatch8.6
Node
debiandebian_linuxMatch10.0
VendorProductVersionCPE
libarchivelibarchive*cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*
fedoraprojectfedora35cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
redhatenterprise_linux8.0cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
redhatenterprise_linux_eus8.6cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
redhatenterprise_linux_for_ibm_z_systems8.0cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*
redhatenterprise_linux_for_ibm_z_systems_eus8.6cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*
redhatenterprise_linux_for_power_little_endian8.0cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*
redhatenterprise_linux_for_power_little_endian_eus8.6cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*
redhatenterprise_linux_server_aus8.6cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
redhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.6cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
Rows per page:
1-10 of 131

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "libarchive",
    "versions": [
      {
        "version": "Fixed in libarchive 3.5.2",
        "status": "affected"
      }
    ]
  }
]

Social References

More

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

25.2%