Improper Link Resolution Flaw in libarchive
Summary
CVE-2021-31566: An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. Affects libarchive across 2 version ranges.
< 3.5.3-r0
< b41daecb5ccb4c8e3b2c53fd6147109fc12c3043
Fixed in 3.5.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is an open-source library that provides a flexible interface for reading and writing various archive formats. It is commonly used in software applications to handle compressed files and archives. The library allows users to extract files from archives and perform various operations on them. However, a vulnerability has been discovered in libarchive that can lead to unauthorized changes to files outside of the archive.
Vulnerability Detail
The vulnerability, identified as CVE-2021-31566, is an improper link resolution flaw that occurs during the extraction of an archive. When a user tries to extract a malicious archive, this flaw can be triggered, resulting in the modification of modes, times, access control lists, and flags of a file outside of the archive. This can be exploited by a local attacker to gain elevated privileges on the system. The vulnerability has a CVSS score of 7.8, indicating a high severity.
How To Fix
Minimum fixed version
3.5.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the official patch or update the affected package to mitigate the risk.
Conclusion
The improper link resolution flaw in libarchive can lead to unauthorized modifications of files outside of the archive, potentially allowing an attacker to gain elevated privileges. It is crucial to update the libarchive package to the latest version or apply the provided patch to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libarchive →
FAQ
libarchive is an open-source library used for reading and writing various archive formats. It provides a flexible interface for handling compressed files and archives.
The vulnerability allows a local attacker to modify files outside of the archive, potentially gaining elevated privileges on the system.
To fix this vulnerability, update the libarchive package to version 3.5.3-r0 or later.
No, there is no known workaround for this vulnerability. It is essential to apply the official patch or update the affected package.
The CVSS score of this vulnerability is 7.8, indicating a high severity.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
