CVE-2021-23177
Fixed in a distro release EPSS <1%
An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.
Products: libarchive, fedoraproject fedora, redhat enterprise_linux, redhat enterprise_linux_eus, redhat enterprise_linux_for_ibm_z_systems, redhat enterprise_linux_for_ibm_z_systems_eus, redhat enterprise_linux_for_power_little_endian, redhat enterprise_linux_for_power_little_endian_eus, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions, redhat enterprise_linux_server_tus, redhat codeready_linux_builder, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | bsdtar | 3.3.3-3.el8_5 |
| AlmaLinux 8 | libarchive | 3.3.3-3.el8_5 |
| AlmaLinux 8 | libarchive-devel | 3.3.3-3.el8_5 |
| Debian 10 | libarchive | 3.3.3-4+deb10u2 |
| Debian 12 | libarchive | 3.5.2-1 |
| Debian 13 | libarchive | 3.5.2-1 |
| Debian 14 | libarchive | 3.5.2-1 |
| Debian 9 | libarchive | 3.2.2-2+deb9u3 |
| Red Hat Enterprise Linux 8 | bsdcat-debuginfo | 0:3.3.3-3.el8_5 |
| Red Hat Enterprise Linux 8 | bsdcpio-debuginfo | 0:3.3.3-3.el8_5 |
| Red Hat Enterprise Linux 8 | bsdtar | 0:3.3.3-3.el8_5 |
| Red Hat Enterprise Linux 8 | bsdtar-debuginfo | 0:3.3.3-3.el8_5 |
| Red Hat Enterprise Linux 8 | libarchive | 0:3.3.3-3.el8_5 |
| Red Hat Enterprise Linux 8 | libarchive-debuginfo | 0:3.3.3-3.el8_5 |
| Red Hat Enterprise Linux 8 | libarchive-debugsource | 0:3.3.3-3.el8_5 |
| Red Hat Enterprise Linux 8 | libarchive-devel | 0:3.3.3-3.el8_5 |
| Rocky Linux 8 | libarchive | 0:3.3.3-3.el8_5 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | libarchive | 3.4.2-150200.4.9.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | libarchive | 3.5.1-150400.3.6.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | libarchive | 3.4.2-150200.4.9.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | libarchive | 3.5.1-150400.3.6.1 |
| Ubuntu 20.04 LTS | libarchive | 3.4.0-2ubuntu1.1 |
| Ubuntu Pro 14.04 LTS | libarchive | no fix |
| Ubuntu Pro 16.04 LTS | libarchive | no fix |
| Ubuntu Pro 18.04 LTS | libarchive | no fix |
| openSUSE Leap 15.3 | libarchive | 3.4.2-150200.4.9.1 |
| openSUSE Leap 15.4 | libarchive | 3.5.1-150400.3.6.1 |
| openSUSE Tumbleweed | bsdtar | 3.7.2-1.1 |