UNIX symbolic link following in libarchive - CVE-2021-31566

Vulnerability identifier: #VU61394

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-31566

CWE-ID: CWE-61

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue when extracting files from the archive. A local user can create a specially crafted symbolic link to a critical file on the system, place it into an archive and modify modes, times, access control lists, and flags of a file outside of the archive.

libarchive
Gentoo Linux
Amazon Linux AMI
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
Ubuntu
Fedora
Red Hat OpenShift GitOps
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
Red Hat Advanced Cluster Management for Kubernetes
Ansible Automation Platform
Red Hat Advanced Cluster Security for Kubernetes
Netcool Operations Insight
Splunk Universal Forwarder
Splunk Enterprise
Red Hat OpenShift Serverless
OpenShift Virtualization
libarchive (Red Hat package)
libarchive
bsdtar
libarchive13 (Ubuntu package)
bsdtar-debuginfo
libarchive-debugsource
libarchive-devel
libarchive13
libarchive13-debuginfo
libarchive13-32bit
libarchive13-32bit-debuginfo
libarchive-debuginfo
libarchive-help
app-arch/libarchive

Install updates from vendor's website.

libarchive - update to 3.5.2
Red Hat OpenShift GitOps - addressed in versions 1.2.3, 1.3.6, 1.4.4
Migration Toolkit for Containers - addressed in versions 1.5.4, 1.7.1, 1.7.4
Cloud Pak for Security (CP4S) - update to 1.10.7.0
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.3.8, 2.4.3
Red Hat Advanced Cluster Security for Kubernetes - update to 3.68.2
Red Hat OpenShift Container Platform - addressed in versions 4.11.0, 4.11.45
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 12, 7.4.3 Fix Pack 6, 7.5.0 Update Pack 2
Splunk Universal Forwarder - addressed in versions 8.1.14, 8.2.11, 9.0.5
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
Red Hat OpenShift Serverless - update to 1
Netcool Operations Insight - update to 1.6.6
libarchive (Red Hat package) - update to 3.3.3-3.el8_5
libarchive - update to 3.3.3-3.0.1
bsdtar - update to 3.3.3-3.0.1
libarchive13 (Ubuntu package) - addressed in versions 3.4.0-2ubuntu1.1, 3.4.3-2ubuntu0.1
bsdtar - addressed in versions 3.4.2-150200.4.12.1, 3.5.1-150400.3.9.1
bsdtar-debuginfo - addressed in versions 3.4.2-150200.4.12.1, 3.5.1-150400.3.9.1
libarchive-debugsource - addressed in versions 3.4.2-150200.4.12.1, 3.5.1-150400.3.9.1
libarchive-devel - addressed in versions 3.4.2-150200.4.12.1, 3.5.1-150400.3.9.1
libarchive13 - addressed in versions 3.4.2-150200.4.12.1, 3.5.1-150400.3.9.1
libarchive13-debuginfo - addressed in versions 3.4.2-150200.4.12.1, 3.5.1-150400.3.9.1
libarchive13-32bit - addressed in versions 3.4.2-150200.4.12.1, 3.5.1-150400.3.9.1
libarchive13-32bit-debuginfo - addressed in versions 3.4.2-150200.4.12.1, 3.5.1-150400.3.9.1
libarchive - update to 3.4.3-4
libarchive-debuginfo - update to 3.4.3-4
libarchive-debugsource - update to 3.4.3-4
libarchive-devel - update to 3.4.3-4
libarchive-help - update to 3.4.3-4
libarchive - update to 3.5.3-1.fc35
libarchive - update to 3.5.3-2
app-arch/libarchive - update to 3.6.1
OpenShift Virtualization - update to 4.11.0

• https://bugzilla.redhat.com/show_bug.cgi?id=2024237

• Multiple vulnerabilities in libarchive
• Red Hat Enterprise Linux 8 update for libarchive
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.2
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.4
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.3
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Ubuntu update for libarchive
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Gentoo update for libarchive
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in OpenShift Virtualization
• SUSE update for libarchive
• SUSE update for libarchive
• Multiple vulnerabilities in Netcool Operations Insight
• Splunk Universal Forwarder update for third-party packages
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4
• openEuler update for libarchive
• Amazon Linux AMI update for libarchive
• Multiple vulnerabilities in Migration Toolkit for Containers 1.5
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.4
• Multiple vulnerabilities in Migration Toolkit for Containers 1.7
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Fedora 35 update for libarchive
• Anolis OS update for libarchive