Lucene search
HistoryAug 23, 2022 - 4:15 p.m.
CVE-2021-31566
improper link resolution
archive extraction
privilege escalation
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
25.2%
An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.
Affected configurations
Node
libarchivelibarchiveRange<3.5.2
Node
fedoraprojectfedoraMatch35
Node
redhatenterprise_linuxMatch8.0
ORredhatenterprise_linux_eusMatch8.6
ORredhatenterprise_linux_for_ibm_z_systemsMatch8.0
ORredhatenterprise_linux_for_ibm_z_systems_eusMatch8.6
ORredhatenterprise_linux_for_power_little_endianMatch8.0
ORredhatenterprise_linux_for_power_little_endian_eusMatch8.6
ORredhatenterprise_linux_server_ausMatch8.6
ORredhatenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsMatch8.6
ORredhatenterprise_linux_server_tusMatch8.6
Node
redhatenterprise_linuxMatch8.0
ORredhatenterprise_linux_eusMatch8.6
ORredhatenterprise_linux_for_ibm_z_systemsMatch8.0
ORredhatenterprise_linux_for_ibm_z_systems_eusMatch8.6
ORredhatenterprise_linux_for_power_little_endianMatch8.0
ORredhatenterprise_linux_for_power_little_endian_eusMatch8.6
redhatcodeready_linux_builderMatch-
Node
debiandebian_linuxMatch10.0
Node
splunkuniversal_forwarderRange8.2.0–8.2.12
ORsplunkuniversal_forwarderRange9.0.0–9.0.6
ORsplunkuniversal_forwarderMatch9.1.0
| Vendor | Product | Version | CPE |
|---|---|---|---|
| libarchive | libarchive | * | cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:* |
| fedoraproject | fedora | 35 | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 8.0 | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 8.6 | cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_ibm_z_systems | 8.0 | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.6 | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_little_endian | 8.0 | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.6 | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus | 8.6 | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.6 | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* |
Related
nessus
nessus
SUSE SLED15 / SLES15 Security Update : libarchive (SUSE-SU-2022:3936-1)
2022-11-13 00:00:00
SUSE SLED15 / SLES15 Security Update : libarchive (SUSE-SU-2022:3935-1)
2022-11-13 00:00:00
F5 Networks BIG-IP : libarchive vulnerability (K000140963)
2024-09-06 00:00:00
alpinelinux
alpinelinux
CVE-2021-31566
2022-08-23 16:15:09
veracode
veracode
Arbitrary File Write
2022-04-10 22:49:47
f5
f5
K000140963: libarchive vulnerability CVE-2021-31566
2024-09-06 00:00:00
prion
prion
Input validation
2022-08-23 16:15:00
ubuntucve
ubuntucve
CVE-2021-31566
2021-12-24 00:00:00
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2022:3935-1)
2022-11-11 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:3936-1)
2022-11-11 00:00:00
Huawei EulerOS: Security Advisory for libarchive (EulerOS-SA-2022-1509)
2022-04-20 00:00:00
debiancve
debiancve
CVE-2021-31566
2022-08-23 16:15:09
redhatcve
redhatcve
CVE-2021-31566
2021-12-16 10:55:05
amazon
amazon
Medium: libarchive
2023-11-29 22:20:00
cvelist
cvelist
CVE-2021-31566
2022-08-23 00:00:00
osv
osv
CVE-2021-31566
2022-08-23 16:15:09
Moderate: libarchive security update
2022-03-15 09:11:33
bsdtar-3.6.0-1.1 on GA media
2024-06-15 00:00:00
cve
cve
CVE-2021-31566
2022-08-23 16:15:09
fedora
fedora
[SECURITY] Fedora 35 Update: libarchive-3.5.3-1.fc35
2022-02-24 23:09:25
rocky
rocky
libarchive security update
2022-03-15 09:11:33
redhat
redhat
(RHSA-2022:0892) Moderate: libarchive security update
2022-03-15 09:11:33
(RHSA-2022:5132) Important: RHACS 3.68 security update
2022-06-20 17:18:52
(RHSA-2022:1039) Important: Red Hat OpenShift GitOps security update
2022-03-23 21:13:24
almalinux
almalinux
Moderate: libarchive security update
2022-03-15 09:11:33
mageia
mageia
Updated libarchive packages fix security vulnerability
2022-02-12 20:31:35
photon
photon
Important Photon OS Security Update - PHSA-2022-0246
2022-09-16 00:00:00
Important Photon OS Security Update - PHSA-2022-4.0-0246
2022-09-16 00:00:00
Important Photon OS Security Update - PHSA-2022-3.0-0447
2022-09-07 00:00:00
redos
redos
ROS-20220322-02
2022-03-22 00:00:00
oraclelinux
oraclelinux
libarchive security update
2022-03-16 00:00:00
debian
debian
[SECURITY] [DLA 3202-1] libarchive security update
2022-11-22 17:32:50
[SECURITY] [DLA 2987-1] libarchive security update
2022-04-30 22:21:35
ubuntu
ubuntu
libarchive vulnerabilities
2022-02-17 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2023-2205
2023-08-01 13:07:57
gentoo
gentoo
libarchive: Multiple Vulnerabilities
2022-08-14 00:00:00
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
25.2%
Related for NVD:CVE-2021-31566