Critical Security Update for libarchive: Addressing Vulnerabilities in Red Hat Packages
Summary
RHSA-2025:7510: Red Hat Security Advisory: libarchive security update. Affects bsdcat-debuginfo versions < 0:3.7.7-2.el10_0. Fixed in 0:3.7.7-2.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a widely used library that provides a flexible and efficient way to read and write various archive formats, including tar, cpio, and zip. It is integral to many applications in the Red Hat Enterprise Linux ecosystem, enabling users to manage compressed files and archives seamlessly. However, vulnerabilities in libarchive can lead to security risks, potentially allowing unauthorized access or manipulation of archived data.
Vulnerability Detail
The vulnerability identified in libarchive and its associated packages stems from improper handling of certain archive formats, which could be exploited by attackers to execute arbitrary code or cause denial of service. This issue is particularly concerning as it affects multiple packages, including bsdcat, bsdcpio, and bsdtar, all of which rely on libarchive for their functionality. The vulnerability has a CVSS score of 4.0, indicating a moderate level of risk that could lead to significant consequences if left unaddressed.
How To Fix
Minimum fixed version
0:3.7.7-2.el10_0
This is the first release that contains the fix.
sudo dnf update bsdcat-debuginfoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of the affected packages until they are updated. Avoid using libarchive for untrusted archives or files until the vulnerability is patched.
Conclusion
The identified vulnerability in libarchive and its related packages poses a moderate risk to users of Red Hat Enterprise Linux. It is crucial to update to the patched version to mitigate potential security threats. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for bsdcat-debuginfo →
FAQ
The vulnerability involves improper handling of archive formats, which could allow attackers to execute arbitrary code.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The CVSS score of this vulnerability is 4.0, indicating a moderate risk level.
If immediate updates are not possible, limit the use of the affected packages and avoid processing untrusted archives.
Detailed information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2025:7510.json.
Related vulnerabilities
Recent vulnerabilities recorded for bsdcat-debuginfo.
