Critical Security Update for libarchive and Related Packages - RHSA-2025:14137
Summary
RHSA-2025:14137: Red Hat Security Advisory: libarchive security update. Affects bsdcat-debuginfo versions < 0:3.7.7-4.el10_0. Fixed in 0:3.7.7-4.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libarchive is a widely used library that provides a flexible and efficient way to read and write various archive formats, including tar, zip, and cpio. It is essential for applications that require file compression and decompression functionalities. The recent vulnerability affects multiple packages associated with libarchive, including bsdcat, bsdcpio, bsdtar, and their respective debug information packages. This vulnerability could potentially allow unauthorized access to sensitive data and compromise system integrity.
Vulnerability Detail
The vulnerability identified in libarchive and its related packages is a security flaw that allows attackers to exploit the library's handling of archive files. This could lead to unauthorized access to sensitive information, data corruption, or even system crashes. The flaw originates from improper validation of input data, which can be manipulated by an attacker to execute arbitrary code or gain elevated privileges. The CVSS score for this vulnerability is 7.3, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
0:3.7.7-4.el10_0
This is the first release that contains the fix.
sudo dnf update bsdcat-debuginfoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the affected applications or services until the update can be applied. Additionally, monitor your systems for any unusual activity that may indicate exploitation of this vulnerability.
Conclusion
In summary, the libarchive vulnerability poses a significant risk to systems using the affected packages. It is essential to apply the available patches promptly to mitigate the risk of exploitation. Users should also consider using tools like Vulert to monitor their applications for vulnerabilities continuously.
See every vulnerability recorded for bsdcat-debuginfo →
FAQ
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
The affected packages include bsdcat-debuginfo, bsdcpio-debuginfo, bsdtar, bsdtar-debuginfo, bsdunzip-debuginfo, libarchive, libarchive-debuginfo, libarchive-debugsource, and libarchive-devel.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup at Vulert Scanner.
If you cannot apply the patch immediately, consider restricting access to the affected applications or services and monitor your systems for unusual activity.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2025:14137.json.
Related vulnerabilities
Recent vulnerabilities recorded for bsdcat-debuginfo.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
