NULL pointer dereference in libarchive - CVE-2022-36227

Vulnerability identifier: #VU69582

CSH Severity: Low

CVSS v4 BT: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-36227

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in libarchive. A remote attacker can pass a specially crafted archive to the application and perform a denial of service (DoS) attack.

libarchive
EMC ViPR SRM
Amazon Linux AMI
Oracle Linux
Gentoo Linux
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Oracle Solaris
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
Ubuntu
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
openSUSE Leap
openEuler
Fedora
Gatekeeper Operator
VolSync
Run Once Duration Override Operator for Red Hat OpenShift
Migration Toolkit for Runtimes
Service Telemetry Framework
cert-manager Operator for Red Hat OpenShift
Migration Toolkit for Virtualization
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift Dev Spaces
Red Hat Advanced Cluster Security for Kubernetes
OpenShift Logging
Red Hat OpenStack
IBM MQ Operator
Custom Metrics Autoscaler Operator for Red Hat OpenShift
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Robotic Process Automation
Node Health Check Operator
Self Node Remediation Operator
Red Hat OpenShift Serverless
OpenShift sandboxed containers
Multicluster Engine for Kubernetes
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
Node Maintenance Operator
OpenShift Container Platform for Windows Containers
Windows Container Support for Red Hat OpenShift
Secondary Scheduler Operator for Red Hat OpenShift (OSSO)
OpenShift API for Data Protection (OADP)
Network Observability plugin for the Openshift Console
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
OpenShift Developer Tools and Services
Splunk Universal Forwarder
Splunk Enterprise
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libarchive13 (Ubuntu package)
libarchive (Red Hat package)
libarchive13-debuginfo
libarchive13
libarchive-devel
libarchive-debugsource
bsdtar-debuginfo
bsdtar
libarchive13-32bit
libarchive13-32bit-debuginfo
libarchive
libarchive-help
libarchive-debuginfo
bsdcat
bsdcpio
app-arch/libarchive
libarchive13t64 (Ubuntu package)
Red Hat OpenShift GitOps
IBM Cloud Pak for Watson AIOps
Dell EMC Storage Monitoring and Reporting (SMR)

Install update from vendor's website.

Node Health Check Operator - update to 0.4.1
Self Node Remediation Operator - update to 0.5.1
VolSync - addressed in versions 0.5.4, 0.6.3
Run Once Duration Override Operator for Red Hat OpenShift - update to 1.0.1
Secondary Scheduler Operator for Red Hat OpenShift (OSSO) - update to 1.1.2
Red Hat OpenShift Serverless - addressed in versions 1.29.0, 1.29.1
Migration Toolkit for Runtimes - addressed in versions 1.1.0, 1.1.1
OpenShift API for Data Protection (OADP) - update to 1.1.5
OpenShift sandboxed containers - update to 1.4.1
Service Telemetry Framework - update to 1.5.4
Migration Toolkit for Containers - update to 1.7.10
cert-manager Operator for Red Hat OpenShift - update to 1.10.3
Multicluster Engine for Kubernetes - addressed in versions 2.0.9, 2.1.7, 2.2.4, 2.5.8
OpenShift Service Mesh - addressed in versions 2.2.7, 2.4.0, 2.4.8, 2.5.2
Migration Toolkit for Virtualization - update to 2.4.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.5.9, 2.6.6, 2.7.4
Red Hat OpenShift Dev Spaces - addressed in versions 3.7.1, 3.15.0, 3.16.0, 3.17.0
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 3.73.5, 3.74.4
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.11.9, 4.12.3, 4.12.4, 4.13.0
Red Hat OpenShift Container Platform - addressed in versions 4.11.57, 4.12.47, 4.13.2, 4.13.4, 4.13.45, 4.14.32, 4.14.33
Node Maintenance Operator - update to 5.0.1
OpenShift Logging - update to 5.7.2
OpenShift Container Platform for Windows Containers - update to 6.0.1
Splunk Universal Forwarder - addressed in versions 8.1.14, 8.2.11, 9.0.5
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
libarchive13 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.4.0-2ubuntu1.3, 3.6.0-1ubuntu1.2
Network Observability plugin for the Openshift Console - update to 1.3.0
Red Hat OpenShift GitOps - addressed in versions 1.12.5, 1.13.1
IBM MQ Operator - addressed in versions 2.0.13, 2.4.1
Custom Metrics Autoscaler Operator for Red Hat OpenShift - update to 2.12.1-376
libarchive (Red Hat package) - addressed in versions 3.3.3-4.el8_6, 3.3.3-5.el8, 3.5.3-4.el9
libarchive13-debuginfo - addressed in versions 3.3.3-32.8.1, 3.4.2-150200.4.15.1, 3.5.1-150400.3.12.1
libarchive13 - addressed in versions 3.3.3-32.8.1, 3.4.2-150200.4.15.1, 3.5.1-150400.3.12.1
libarchive-devel - addressed in versions 3.3.3-32.8.1, 3.4.2-150200.4.15.1, 3.5.1-150400.3.12.1
libarchive-debugsource - addressed in versions 3.3.3-32.8.1, 3.4.2-150200.4.15.1, 3.5.1-150400.3.12.1
bsdtar-debuginfo - addressed in versions 3.4.2-150200.4.15.1, 3.5.1-150400.3.12.1
bsdtar - addressed in versions 3.4.2-150200.4.15.1, 3.5.1-150400.3.12.1
libarchive13-32bit - addressed in versions 3.4.2-150200.4.15.1, 3.5.1-150400.3.12.1
libarchive13-32bit-debuginfo - addressed in versions 3.4.2-150200.4.15.1, 3.5.1-150400.3.12.1
libarchive - addressed in versions 3.4.3-6, 3.5.2-5
libarchive-help - addressed in versions 3.4.3-6, 3.5.2-5
libarchive-debuginfo - addressed in versions 3.4.3-6, 3.5.2-5
libarchive-devel - addressed in versions 3.4.3-6, 3.5.2-5
libarchive-debugsource - addressed in versions 3.4.3-6, 3.5.2-5
bsdcat - update to 3.5.2-5
bsdcpio - update to 3.5.2-5
bsdtar - update to 3.5.2-5
libarchive - update to 3.5.3-2
libarchive - update to 3.5.3-4
bsdtar - update to 3.5.3-4
libarchive - update to 3.6.1-3.fc37
app-arch/libarchive - update to 3.7.1
libarchive13t64 (Ubuntu package) - update to 3.7.2-2ubuntu0.2
IBM Cloud Pak for Watson AIOps - update to 4.2.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.7.1
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.9.0.0
EMC ViPR SRM - update to 4.9.0.0
Windows Container Support for Red Hat OpenShift - update to 7.1.0
IBM Robotic Process Automation - addressed in versions 21.0.7.8, 23.0.9

• https://github.com/libarchive/libarchive/issues/1754
• https://bugs.gentoo.org/882521

• Denial of service in libarchive
• SUSE update for libarchive
• SUSE update for libarchive
• SUSE update for libarchive
• Multiple vulnerabilities in Oracle Solaris
• Red Hat Enterprise Linux 9 update for libarchive
• Red Hat Enterprise Linux 8 update for libarchive
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.12
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.7
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.2
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.1
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.6
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 3.73
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.5
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.0
• Splunk Universal Forwarder update for third-party packages
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 3.74
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.7
• OpenShift Data Foundation 4.12 update for kube-apiserver
• Migration Toolkit for Containers (MTC) 1.7 update for golang
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.4
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.2
• Multiple vulnerabilities in OpenShift Developer Tools and Services 4.11
• Multiple vulnerabilities in OpenShift Developer Tools and Services 4.12
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP)
• Multiple vulnerabilities in Red Hat OpenShift support for Windows containers
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.11
• Multiple vulnerabilities in OpenShift sandboxed containers 1.4
• NULL pointer dereference in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in Red Hat Gatekeeper Operator
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Red Hat OpenShift support for Windows Containers 6.0
• Multiple vulnerabilities in cert-manager Operator for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat VolSync 0.6
• Multiple vulnerabilities in Red Hat VolSync 0.5
• Multiple vulnerabilities in Red Hat OpenStack
• Multiple vulnerabilities in Secondary Scheduler Operator for Red Hat OpenShift
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Gentoo update for libarchive
• Multiple vulnerabilities in Red Hat OpenShift Container Platform release 4.13
• Multiple vulnerabilities in Red Hat Self Node Remediation Operator 0.5
• Multiple vulnerabilities in Red Hat Node Maintenance Operator 5.0
• Multiple vulnerabilities in Run Once Duration Override Operator for Red Hat OpenShift
• Multiple vulnerabilities in Node Health Check Operator 0.4
• Multiple vulnerabilities in Migration Toolkit for Virtualization 2.4
• Red Hat Enterprise Linux 8.6 Extended Update Support update for libarchive
• Red Hat OpenShift Container Platform 4.12 update for golang
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.11
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• openEuler 20.03 LTS SP3 update for libarchive
• openEuler 22.03 LTS update for libarchive
• openEuler 20.03 LTS SP1 update for libarchive
• Multiple vulnerabilities in Service Telemetry Framework 1.5
• Multiple vulnerabilities in Custom Metrics Autoscaler Operator for Red Hat OpenShift
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.13
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Ubuntu update for libarchive
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.17
• Fedora 37 update for libarchive
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.5
• Amazon Linux AMI update for libarchive
• Anolis OS update for libarchive