PT-2020-15381 · Github · Libarchive

Sanjevk001 · Published 2020-10-15 · Updated 2020-10-26 · CVE-2020-21674

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive version 3.4.1dev

Description A heap-based buffer overflow issue exists, allowing remote attackers to cause a denial of service via a crafted archive file. This issue affects users who downloaded the development code from GitHub, while users of the product's official releases are unaffected.

Recommendations For libarchive version 3.4.1dev, consider avoiding the use of crafted archive files until a patch is available. As a temporary workaround, restrict the use of the archive string append from wcs() function in archive string.c to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-21674

Affected Products

Libarchive

References · 4

• https://github.com/libarchive/libarchive/commit/4f085eea879e2be745f4d9bf57e8513ae48157f4 · Patch
• https://osv.dev/vulnerability/CVE-2020-21674 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-21674 · Security Note
• https://github.com/libarchive/libarchive/issues/1298 · Note