OESA-2022-1494

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1494
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2022-1494.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2022-1494
Upstream
Published
2022-01-22T11:03:28Z
Modified
2025-08-12T05:07:27.621125Z
Summary
libarchive security update
Details

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

Incorrect link resolution flaws can occur when extracting archives, resulting in changes to the mode, time, access control list, and flags of files outside the archive. An attacker could deliver malicious archives to victim users, triggering this vulnerability when they attempt to extract the archives. A local attacker could exploit this vulnerability to gain additional privileges on the system.(CVE-2021-31566)

Incorrect link resolution flaws when using ACLs to extract symbolic links can lead to changes to the access control list (ACL) of the link target. An attacker could deliver malicious archives to victim users, triggering this vulnerability when they attempt to extract the archives. A local attacker could exploit this vulnerability to change the ACL of a file on the system and gain more permissions.(CVE-2021-23177)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / libarchive

Package

Name
libarchive
Purl
pkg:rpm/openEuler/libarchive&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.3-4.oe1

Ecosystem specific 

{
    "x86_64": [
        "libarchive-debuginfo-3.4.3-4.oe1.x86_64.rpm",
        "libarchive-3.4.3-4.oe1.x86_64.rpm",
        "libarchive-debugsource-3.4.3-4.oe1.x86_64.rpm",
        "libarchive-devel-3.4.3-4.oe1.x86_64.rpm"
    ],
    "src": [
        "libarchive-3.4.3-4.oe1.src.rpm"
    ],
    "aarch64": [
        "libarchive-debuginfo-3.4.3-4.oe1.aarch64.rpm",
        "libarchive-debugsource-3.4.3-4.oe1.aarch64.rpm",
        "libarchive-devel-3.4.3-4.oe1.aarch64.rpm",
        "libarchive-3.4.3-4.oe1.aarch64.rpm"
    ],
    "noarch": [
        "libarchive-help-3.4.3-4.oe1.noarch.rpm"
    ]
}

openEuler:20.03-LTS-SP2 / libarchive

Package

Name
libarchive
Purl
pkg:rpm/openEuler/libarchive&distro=openEuler-20.03-LTS-SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.3-4.oe1

Ecosystem specific 

{
    "x86_64": [
        "libarchive-debugsource-3.4.3-4.oe1.x86_64.rpm",
        "libarchive-3.4.3-4.oe1.x86_64.rpm",
        "libarchive-debuginfo-3.4.3-4.oe1.x86_64.rpm",
        "libarchive-devel-3.4.3-4.oe1.x86_64.rpm"
    ],
    "src": [
        "libarchive-3.4.3-4.oe1.src.rpm"
    ],
    "aarch64": [
        "libarchive-debuginfo-3.4.3-4.oe1.aarch64.rpm",
        "libarchive-devel-3.4.3-4.oe1.aarch64.rpm",
        "libarchive-debugsource-3.4.3-4.oe1.aarch64.rpm",
        "libarchive-3.4.3-4.oe1.aarch64.rpm"
    ],
    "noarch": [
        "libarchive-help-3.4.3-4.oe1.noarch.rpm"
    ]
}

openEuler:20.03-LTS-SP3 / libarchive

Package

Name
libarchive
Purl
pkg:rpm/openEuler/libarchive&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.3-4.oe1

Ecosystem specific 

{
    "x86_64": [
        "libarchive-debuginfo-3.4.3-4.oe1.x86_64.rpm",
        "libarchive-3.4.3-4.oe1.x86_64.rpm",
        "libarchive-devel-3.4.3-4.oe1.x86_64.rpm",
        "libarchive-debugsource-3.4.3-4.oe1.x86_64.rpm"
    ],
    "src": [
        "libarchive-3.4.3-4.oe1.src.rpm"
    ],
    "aarch64": [
        "libarchive-3.4.3-4.oe1.aarch64.rpm",
        "libarchive-debugsource-3.4.3-4.oe1.aarch64.rpm",
        "libarchive-devel-3.4.3-4.oe1.aarch64.rpm",
        "libarchive-debuginfo-3.4.3-4.oe1.aarch64.rpm"
    ],
    "noarch": [
        "libarchive-help-3.4.3-4.oe1.noarch.rpm"
    ]
}