Moderate: libarchive security update
Summary
ALSA-2020:4443: Moderate: libarchive security update. Affects libarchive-devel versions < 3.3.2-9.el8. Fixed in 3.3.2-9.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libarchive programming library is used to create and read various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is utilized in tools like bsdtar, scripting language bindings such as python-libarchive, and popular desktop file managers.
Vulnerability Detail
The libarchive library is affected by an out-of-bounds read vulnerability in the archive_wstring_append_from_mbs function in archive_string.c. This vulnerability is identified as CVE-2019-19221. An attacker could exploit this vulnerability to read data outside the bounds of a buffer, potentially leading to information disclosure or a denial of service.
How To Fix
Minimum fixed version
3.3.2-9.el8
This is the first release that contains the fix.
sudo dnf update libarchive-develTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the libarchive library is affected by an out-of-bounds read vulnerability. To mitigate this issue, it is crucial to update the libarchive package to version 3.3.2-9.el8 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libarchive-devel →
FAQ
Libarchive is a programming library used for creating and reading streaming archive formats.
The vulnerability could allow an attacker to read data outside the bounds of a buffer, potentially leading to information disclosure or a denial of service.
The vulnerability affects libarchive-devel package in AlmaLinux 8, specifically versions prior to 3.3.2-9.el8.
No known workarounds are available for this vulnerability. It is recommended to update to the patched version.
You can find more information about this vulnerability in the CVE page: CVE-2019-19221.
References
Related vulnerabilities
Recent vulnerabilities recorded for libarchive-devel.
