PT-2021-6390 · Unknown+10 · Libarchive+10

Mmatuska · Published 2021-12-24 · Updated 2025-11-25 · CVE-2021-23177

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libarchive (affected versions not specified)

Description An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-61

CWE-59

Related Identifiers

ALSA-2022:0892

ALT-PU-2022-1454

ALT-PU-2022-1524

ALT-PU-2022-3332

BDU:2022-01463

CESA-2022_0892

CVE-2021-23177

DLA-2987-1

DLA-3202-1

JLSEC-2025-235

OESA-2022-1494

OPENSUSE-SU-2022_3306-1

OPENSUSE-SU-2022_3393-1

OPENSUSE-SU-2024:13549-1

RHSA-2022:0892

RHSA-2022_0892

RLSA-2022:0892

SUSE-SU-2022:3306-1

SUSE-SU-2022:3393-1

SUSE-SU-2022_3306-1

SUSE-SU-2022_3393-1

USN-5291-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Libarchive

References · 49

• https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad · Patch
• https://github.com/libarchive/libarchive/issues/1565 · Patch
• https://osv.dev/vulnerability/RLSA-2022:0892 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13549-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-23177 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-36976 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-23177 · Security Note
• https://ubuntu.com/security/CVE-2021-31566 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31566 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2024245 · Patch
• https://osv.dev/vulnerability/OESA-2022-1494 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2987-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23177 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-23177 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5291-1 · Vendor Advisory