Headline
Red Hat Security Advisory 2022-5252-01
Red Hat Security Advisory 2022-5252-01 - The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Issues addressed include an out of bounds read vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: libarchive security update
Advisory ID: RHSA-2022:5252-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:5252
Issue date: 2022-06-28
CVE Names: CVE-2022-26280
====================================================================
- Summary:
An update for libarchive is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact
of
Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.
- Relevant releases/architectures:
Red Hat CodeReady Linux Builder (v. 9) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux BaseOS (v. 9) - aarch64, ppc64le, s390x, x86_64
- Description:
The libarchive programming library can create and read several different
streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM
images.
Libarchive is used notably in the bsdtar utility, scripting language
bindings
such as python-libarchive, and several popular desktop file managers.
Security Fix(es):
- libarchive: an out-of-bounds read via the component zipx_lzma_alone_init
(CVE-2022-26280)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in
this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2071931 - CVE-2022-26280 libarchive: an out-of-bounds read via the component zipx_lzma_alone_init
- Package List:
Red Hat Enterprise Linux AppStream (v. 9):
aarch64:
bsdcat-debuginfo-3.5.3-2.el9_0.aarch64.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.aarch64.rpm
bsdtar-3.5.3-2.el9_0.aarch64.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.aarch64.rpm
libarchive-debuginfo-3.5.3-2.el9_0.aarch64.rpm
libarchive-debugsource-3.5.3-2.el9_0.aarch64.rpm
ppc64le:
bsdcat-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
bsdtar-3.5.3-2.el9_0.ppc64le.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
libarchive-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
libarchive-debugsource-3.5.3-2.el9_0.ppc64le.rpm
s390x:
bsdcat-debuginfo-3.5.3-2.el9_0.s390x.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.s390x.rpm
bsdtar-3.5.3-2.el9_0.s390x.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.s390x.rpm
libarchive-debuginfo-3.5.3-2.el9_0.s390x.rpm
libarchive-debugsource-3.5.3-2.el9_0.s390x.rpm
x86_64:
bsdcat-debuginfo-3.5.3-2.el9_0.x86_64.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.x86_64.rpm
bsdtar-3.5.3-2.el9_0.x86_64.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.x86_64.rpm
libarchive-debuginfo-3.5.3-2.el9_0.x86_64.rpm
libarchive-debugsource-3.5.3-2.el9_0.x86_64.rpm
Red Hat Enterprise Linux BaseOS (v. 9):
Source:
libarchive-3.5.3-2.el9_0.src.rpm
aarch64:
bsdcat-debuginfo-3.5.3-2.el9_0.aarch64.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.aarch64.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.aarch64.rpm
libarchive-3.5.3-2.el9_0.aarch64.rpm
libarchive-debuginfo-3.5.3-2.el9_0.aarch64.rpm
libarchive-debugsource-3.5.3-2.el9_0.aarch64.rpm
ppc64le:
bsdcat-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
libarchive-3.5.3-2.el9_0.ppc64le.rpm
libarchive-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
libarchive-debugsource-3.5.3-2.el9_0.ppc64le.rpm
s390x:
bsdcat-debuginfo-3.5.3-2.el9_0.s390x.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.s390x.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.s390x.rpm
libarchive-3.5.3-2.el9_0.s390x.rpm
libarchive-debuginfo-3.5.3-2.el9_0.s390x.rpm
libarchive-debugsource-3.5.3-2.el9_0.s390x.rpm
x86_64:
bsdcat-debuginfo-3.5.3-2.el9_0.i686.rpm
bsdcat-debuginfo-3.5.3-2.el9_0.x86_64.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.i686.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.x86_64.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.i686.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.x86_64.rpm
libarchive-3.5.3-2.el9_0.i686.rpm
libarchive-3.5.3-2.el9_0.x86_64.rpm
libarchive-debuginfo-3.5.3-2.el9_0.i686.rpm
libarchive-debuginfo-3.5.3-2.el9_0.x86_64.rpm
libarchive-debugsource-3.5.3-2.el9_0.i686.rpm
libarchive-debugsource-3.5.3-2.el9_0.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 9):
aarch64:
bsdcat-debuginfo-3.5.3-2.el9_0.aarch64.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.aarch64.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.aarch64.rpm
libarchive-debuginfo-3.5.3-2.el9_0.aarch64.rpm
libarchive-debugsource-3.5.3-2.el9_0.aarch64.rpm
libarchive-devel-3.5.3-2.el9_0.aarch64.rpm
ppc64le:
bsdcat-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
libarchive-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
libarchive-debugsource-3.5.3-2.el9_0.ppc64le.rpm
libarchive-devel-3.5.3-2.el9_0.ppc64le.rpm
s390x:
bsdcat-debuginfo-3.5.3-2.el9_0.s390x.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.s390x.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.s390x.rpm
libarchive-debuginfo-3.5.3-2.el9_0.s390x.rpm
libarchive-debugsource-3.5.3-2.el9_0.s390x.rpm
libarchive-devel-3.5.3-2.el9_0.s390x.rpm
x86_64:
bsdcat-debuginfo-3.5.3-2.el9_0.i686.rpm
bsdcat-debuginfo-3.5.3-2.el9_0.x86_64.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.i686.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.x86_64.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.i686.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.x86_64.rpm
libarchive-debuginfo-3.5.3-2.el9_0.i686.rpm
libarchive-debuginfo-3.5.3-2.el9_0.x86_64.rpm
libarchive-debugsource-3.5.3-2.el9_0.i686.rpm
libarchive-debugsource-3.5.3-2.el9_0.x86_64.rpm
libarchive-devel-3.5.3-2.el9_0.i686.rpm
libarchive-devel-3.5.3-2.el9_0.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2022-26280
https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYr6VotzjgjWX9erEAQgf0A/+NQp1kpX0xhLzDlQxpmnBL9cm5m5NXGzD
tVI2cAb6Xy8LRaL+E4eqxraIzBNvUq03Y7uBzRawzbOJVNiZSQmkHCuHvlVayhB2
98OQjYUe9SkCqOekmSZ+R2oT0iUmYkuGWwLNdeMkA0JVkXsoxmbfrOIunavhUM0k
fWODMqrbK1rhvTwdfKtrxbQXTifp7SwezNLTXvQUmR51Sqrx6/LSj0GQRuY/JKJy
zU7+QuWu1sDBi7lr+wAZNgUX11E8t+iHCaMeHpGWPW1mBh3QOWSGh2mxEtGWTWw/
8I/BWIZfet1LI6nIFhlWPqAZSf+hEOOxEh6fRWp57DtOydLQdSI6b4G2V6voMZK6
cFspD79odvhjVeylrA2wqM/eKSoKhIJuGdu2ydAbBdK+cV0js8jCTZ84KngIbPNH
jgiqTzBcQYeS93zt8m+wwfddAshxzZ+Qoahl6x4SDa1mYxZuGYFjgXS1gidLWYQ1
IVZF7Ln1ggJq57VmPD/6cIzOC7/k6Psp0voheh8S8yoCCqQ5laPlc5zqhfbAFBRT
UeA88T9zMpKon1llEIRM9eDqu5+i0YERbRBjQkaN38WFEv9B32Lz+mHIjat1Y18t
cVuHmzdx39/xBuiUXN5bAvtP+ChSa/QM/tqBZQWy3XaRh+HE8kbRo7SRLsUlbsc0
CHfaY2Lm+3s=BM3q
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Red Hat Security Advisory 2023-3742-02 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, and remote SQL injection vulnerabilities.
Updated images that include numerous enhancements, security, and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4.13.0 on Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-16250: A flaw was found in Vault and Vault Enterprise (“Vault”). In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM ident...
Red Hat Security Advisory 2023-1326-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.13.0. Issues addressed include bypass, denial of service, information leakage, out of bounds read, and remote SQL injection vulnerabilities.
Red Hat OpenShift Container Platform release 4.13.0 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4235: A flaw was found in go-yaml. This issue occurs due to unbounded alias chasing, where a maliciously crafted YAML file can cause the system to consume significant system resources. If p...
Gentoo Linux Security Advisory 202208-26 - Multiple vulnerabilities have been discovered in libarchive, the worst of which could result in arbitrary code execution. Versions less than 3.6.1 are affected.
An update for libarchive is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-26280: libarchive: an out-of-bounds read via the component zipx_lzma_alone_init
Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.