Critical Security Update for libarchive and Related Packages: CVE-2025-9431
Summary
RHSA-2025:9431: Red Hat Security Advisory: libarchive security update. Affects bsdcat-debuginfo versions < 0:3.5.3-5.el9_6. Fixed in 0:3.5.3-5.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a widely used library that provides a flexible interface for reading and writing archive files, such as tar and zip. It is integral to many applications in the Red Hat Enterprise Linux ecosystem, allowing users to manage compressed files efficiently. The library, along with its associated packages like bsdcat, bsdcpio, and bsdtar, is essential for file manipulation and storage management. However, a recent vulnerability has been identified that affects these packages, necessitating immediate attention from users and administrators.
Vulnerability Detail
The vulnerability, identified as CVE-2025-9431, arises from improper handling of certain input data within the libarchive library. This flaw can potentially allow an attacker to exploit the library's functionality, leading to unauthorized access or manipulation of files. The ramifications of this vulnerability include data loss, corruption, or unauthorized disclosure of sensitive information. Given the library's widespread use, the impact could be significant across various applications relying on libarchive for file operations.
How To Fix
Minimum fixed version
0:3.5.3-5.el9_6
This is the first release that contains the fix.
sudo dnf update bsdcat-debuginfoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of the affected packages until they are updated. This may involve avoiding operations that utilize libarchive for file handling or implementing additional security measures to monitor file access.
Conclusion
The identified vulnerability in libarchive and its associated packages poses a significant risk to users and applications relying on these libraries for file management. Immediate action is required to update to the patched version to mitigate potential threats. Users are encouraged to monitor their systems and utilize tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for bsdcat-debuginfo →
FAQ
CVE-2025-9431 is a security vulnerability in the libarchive library that can lead to unauthorized access or manipulation of files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can result in data loss, corruption, or unauthorized disclosure of sensitive information, affecting applications that rely on libarchive.
You can update the affected packages using the command: 'sudo dnf update libarchive bsdcat bsdcpio bsdtar'.
The CVSS score of this vulnerability is 4.0, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for bsdcat-debuginfo.
