RedHat: RHSA-2022-5252:01 Moderate: libarchive security update | Li...

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: libarchive security update
Advisory ID:       RHSA-2022:5252-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:5252
Issue date:        2022-06-28
CVE Names:         CVE-2022-26280 
=====================================================================

1. Summary:

An update for libarchive is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact
of
Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

2. Relevant releases/architectures:

Red Hat CodeReady Linux Builder (v. 9) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux BaseOS (v. 9) - aarch64, ppc64le, s390x, x86_64

3. Description:

The libarchive programming library can create and read several different
streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM
images.
Libarchive is used notably in the bsdtar utility, scripting language
bindings
such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

* libarchive: an out-of-bounds read via the component zipx_lzma_alone_init
(CVE-2022-26280)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in
this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2071931 - CVE-2022-26280 libarchive: an out-of-bounds read via the component zipx_lzma_alone_init

6. Package List:

Red Hat Enterprise Linux AppStream (v. 9):

aarch64:
bsdcat-debuginfo-3.5.3-2.el9_0.aarch64.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.aarch64.rpm
bsdtar-3.5.3-2.el9_0.aarch64.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.aarch64.rpm
libarchive-debuginfo-3.5.3-2.el9_0.aarch64.rpm
libarchive-debugsource-3.5.3-2.el9_0.aarch64.rpm

ppc64le:
bsdcat-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
bsdtar-3.5.3-2.el9_0.ppc64le.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
libarchive-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
libarchive-debugsource-3.5.3-2.el9_0.ppc64le.rpm

s390x:
bsdcat-debuginfo-3.5.3-2.el9_0.s390x.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.s390x.rpm
bsdtar-3.5.3-2.el9_0.s390x.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.s390x.rpm
libarchive-debuginfo-3.5.3-2.el9_0.s390x.rpm
libarchive-debugsource-3.5.3-2.el9_0.s390x.rpm

x86_64:
bsdcat-debuginfo-3.5.3-2.el9_0.x86_64.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.x86_64.rpm
bsdtar-3.5.3-2.el9_0.x86_64.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.x86_64.rpm
libarchive-debuginfo-3.5.3-2.el9_0.x86_64.rpm
libarchive-debugsource-3.5.3-2.el9_0.x86_64.rpm

Red Hat Enterprise Linux BaseOS (v. 9):

Source:
libarchive-3.5.3-2.el9_0.src.rpm

aarch64:
bsdcat-debuginfo-3.5.3-2.el9_0.aarch64.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.aarch64.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.aarch64.rpm
libarchive-3.5.3-2.el9_0.aarch64.rpm
libarchive-debuginfo-3.5.3-2.el9_0.aarch64.rpm
libarchive-debugsource-3.5.3-2.el9_0.aarch64.rpm

ppc64le:
bsdcat-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
libarchive-3.5.3-2.el9_0.ppc64le.rpm
libarchive-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
libarchive-debugsource-3.5.3-2.el9_0.ppc64le.rpm

s390x:
bsdcat-debuginfo-3.5.3-2.el9_0.s390x.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.s390x.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.s390x.rpm
libarchive-3.5.3-2.el9_0.s390x.rpm
libarchive-debuginfo-3.5.3-2.el9_0.s390x.rpm
libarchive-debugsource-3.5.3-2.el9_0.s390x.rpm

x86_64:
bsdcat-debuginfo-3.5.3-2.el9_0.i686.rpm
bsdcat-debuginfo-3.5.3-2.el9_0.x86_64.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.i686.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.x86_64.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.i686.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.x86_64.rpm
libarchive-3.5.3-2.el9_0.i686.rpm
libarchive-3.5.3-2.el9_0.x86_64.rpm
libarchive-debuginfo-3.5.3-2.el9_0.i686.rpm
libarchive-debuginfo-3.5.3-2.el9_0.x86_64.rpm
libarchive-debugsource-3.5.3-2.el9_0.i686.rpm
libarchive-debugsource-3.5.3-2.el9_0.x86_64.rpm

Red Hat CodeReady Linux Builder (v. 9):

aarch64:
bsdcat-debuginfo-3.5.3-2.el9_0.aarch64.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.aarch64.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.aarch64.rpm
libarchive-debuginfo-3.5.3-2.el9_0.aarch64.rpm
libarchive-debugsource-3.5.3-2.el9_0.aarch64.rpm
libarchive-devel-3.5.3-2.el9_0.aarch64.rpm

ppc64le:
bsdcat-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
libarchive-debuginfo-3.5.3-2.el9_0.ppc64le.rpm
libarchive-debugsource-3.5.3-2.el9_0.ppc64le.rpm
libarchive-devel-3.5.3-2.el9_0.ppc64le.rpm

s390x:
bsdcat-debuginfo-3.5.3-2.el9_0.s390x.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.s390x.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.s390x.rpm
libarchive-debuginfo-3.5.3-2.el9_0.s390x.rpm
libarchive-debugsource-3.5.3-2.el9_0.s390x.rpm
libarchive-devel-3.5.3-2.el9_0.s390x.rpm

x86_64:
bsdcat-debuginfo-3.5.3-2.el9_0.i686.rpm
bsdcat-debuginfo-3.5.3-2.el9_0.x86_64.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.i686.rpm
bsdcpio-debuginfo-3.5.3-2.el9_0.x86_64.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.i686.rpm
bsdtar-debuginfo-3.5.3-2.el9_0.x86_64.rpm
libarchive-debuginfo-3.5.3-2.el9_0.i686.rpm
libarchive-debuginfo-3.5.3-2.el9_0.x86_64.rpm
libarchive-debugsource-3.5.3-2.el9_0.i686.rpm
libarchive-debugsource-3.5.3-2.el9_0.x86_64.rpm
libarchive-devel-3.5.3-2.el9_0.i686.rpm
libarchive-devel-3.5.3-2.el9_0.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-26280
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYr6VotzjgjWX9erEAQgf0A/+NQp1kpX0xhLzDlQxpmnBL9cm5m5NXGzD
tVI2cAb6Xy8LRaL+E4eqxraIzBNvUq03Y7uBzRawzbOJVNiZSQmkHCuHvlVayhB2
98OQjYUe9SkCqOekmSZ+R2oT0iUmYkuGWwLNdeMkA0JVkXsoxmbfrOIunavhUM0k
fWODMqrbK1rhvTwdfKtrxbQXTifp7SwezNLTXvQUmR51Sqrx6/LSj0GQRuY/JKJy
zU7+QuWu1sDBi7lr+wAZNgUX11E8t+iHCaMeHpGWPW1mBh3QOWSGh2mxEtGWTWw/
8I/BWIZfet1LI6nIFhlWPqAZSf+hEOOxEh6fRWp57DtOydLQdSI6b4G2V6voMZK6
cFspD79odvhjVeylrA2wqM/eKSoKhIJuGdu2ydAbBdK+cV0js8jCTZ84KngIbPNH
jgiqTzBcQYeS93zt8m+wwfddAshxzZ+Qoahl6x4SDa1mYxZuGYFjgXS1gidLWYQ1
IVZF7Ln1ggJq57VmPD/6cIzOC7/k6Psp0voheh8S8yoCCqQ5laPlc5zqhfbAFBRT
UeA88T9zMpKon1llEIRM9eDqu5+i0YERbRBjQkaN38WFEv9B32Lz+mHIjat1Y18t
cVuHmzdx39/xBuiUXN5bAvtP+ChSa/QM/tqBZQWy3XaRh+HE8kbRo7SRLsUlbsc0
CHfaY2Lm+3s=
=BM3q
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-5252:01 Moderate: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 9

Summary

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.
Security Fix(es):
* libarchive: an out-of-bounds read via the component zipx_lzma_alone_init (CVE-2022-26280)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changesdescribed inthis advisory, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2022-26280 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat Enterprise Linux AppStream (v. 9):
aarch64: bsdcat-debuginfo-3.5.3-2.el9_0.aarch64.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.aarch64.rpm bsdtar-3.5.3-2.el9_0.aarch64.rpm bsdtar-debuginfo-3.5.3-2.el9_0.aarch64.rpm libarchive-debuginfo-3.5.3-2.el9_0.aarch64.rpm libarchive-debugsource-3.5.3-2.el9_0.aarch64.rpm
ppc64le: bsdcat-debuginfo-3.5.3-2.el9_0.ppc64le.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.ppc64le.rpm bsdtar-3.5.3-2.el9_0.ppc64le.rpm bsdtar-debuginfo-3.5.3-2.el9_0.ppc64le.rpm libarchive-debuginfo-3.5.3-2.el9_0.ppc64le.rpm libarchive-debugsource-3.5.3-2.el9_0.ppc64le.rpm
s390x: bsdcat-debuginfo-3.5.3-2.el9_0.s390x.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.s390x.rpm bsdtar-3.5.3-2.el9_0.s390x.rpm bsdtar-debuginfo-3.5.3-2.el9_0.s390x.rpm libarchive-debuginfo-3.5.3-2.el9_0.s390x.rpm libarchive-debugsource-3.5.3-2.el9_0.s390x.rpm
x86_64: bsdcat-debuginfo-3.5.3-2.el9_0.x86_64.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.x86_64.rpm bsdtar-3.5.3-2.el9_0.x86_64.rpm bsdtar-debuginfo-3.5.3-2.el9_0.x86_64.rpm libarchive-debuginfo-3.5.3-2.el9_0.x86_64.rpm libarchive-debugsource-3.5.3-2.el9_0.x86_64.rpm
Red Hat Enterprise Linux BaseOS (v. 9):
Source: libarchive-3.5.3-2.el9_0.src.rpm
aarch64: bsdcat-debuginfo-3.5.3-2.el9_0.aarch64.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.aarch64.rpm bsdtar-debuginfo-3.5.3-2.el9_0.aarch64.rpm libarchive-3.5.3-2.el9_0.aarch64.rpm libarchive-debuginfo-3.5.3-2.el9_0.aarch64.rpm libarchive-debugsource-3.5.3-2.el9_0.aarch64.rpm
ppc64le: bsdcat-debuginfo-3.5.3-2.el9_0.ppc64le.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.ppc64le.rpm bsdtar-debuginfo-3.5.3-2.el9_0.ppc64le.rpm libarchive-3.5.3-2.el9_0.ppc64le.rpm libarchive-debuginfo-3.5.3-2.el9_0.ppc64le.rpm libarchive-debugsource-3.5.3-2.el9_0.ppc64le.rpm
s390x: bsdcat-debuginfo-3.5.3-2.el9_0.s390x.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.s390x.rpm bsdtar-debuginfo-3.5.3-2.el9_0.s390x.rpm libarchive-3.5.3-2.el9_0.s390x.rpm libarchive-debuginfo-3.5.3-2.el9_0.s390x.rpm libarchive-debugsource-3.5.3-2.el9_0.s390x.rpm
x86_64: bsdcat-debuginfo-3.5.3-2.el9_0.i686.rpm bsdcat-debuginfo-3.5.3-2.el9_0.x86_64.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.i686.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.x86_64.rpm bsdtar-debuginfo-3.5.3-2.el9_0.i686.rpm bsdtar-debuginfo-3.5.3-2.el9_0.x86_64.rpm libarchive-3.5.3-2.el9_0.i686.rpm libarchive-3.5.3-2.el9_0.x86_64.rpm libarchive-debuginfo-3.5.3-2.el9_0.i686.rpm libarchive-debuginfo-3.5.3-2.el9_0.x86_64.rpm libarchive-debugsource-3.5.3-2.el9_0.i686.rpm libarchive-debugsource-3.5.3-2.el9_0.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 9):
aarch64: bsdcat-debuginfo-3.5.3-2.el9_0.aarch64.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.aarch64.rpm bsdtar-debuginfo-3.5.3-2.el9_0.aarch64.rpm libarchive-debuginfo-3.5.3-2.el9_0.aarch64.rpm libarchive-debugsource-3.5.3-2.el9_0.aarch64.rpm libarchive-devel-3.5.3-2.el9_0.aarch64.rpm
ppc64le: bsdcat-debuginfo-3.5.3-2.el9_0.ppc64le.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.ppc64le.rpm bsdtar-debuginfo-3.5.3-2.el9_0.ppc64le.rpm libarchive-debuginfo-3.5.3-2.el9_0.ppc64le.rpm libarchive-debugsource-3.5.3-2.el9_0.ppc64le.rpm libarchive-devel-3.5.3-2.el9_0.ppc64le.rpm
s390x: bsdcat-debuginfo-3.5.3-2.el9_0.s390x.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.s390x.rpm bsdtar-debuginfo-3.5.3-2.el9_0.s390x.rpm libarchive-debuginfo-3.5.3-2.el9_0.s390x.rpm libarchive-debugsource-3.5.3-2.el9_0.s390x.rpm libarchive-devel-3.5.3-2.el9_0.s390x.rpm
x86_64: bsdcat-debuginfo-3.5.3-2.el9_0.i686.rpm bsdcat-debuginfo-3.5.3-2.el9_0.x86_64.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.i686.rpm bsdcpio-debuginfo-3.5.3-2.el9_0.x86_64.rpm bsdtar-debuginfo-3.5.3-2.el9_0.i686.rpm bsdtar-debuginfo-3.5.3-2.el9_0.x86_64.rpm libarchive-debuginfo-3.5.3-2.el9_0.i686.rpm libarchive-debuginfo-3.5.3-2.el9_0.x86_64.rpm libarchive-debugsource-3.5.3-2.el9_0.i686.rpm libarchive-debugsource-3.5.3-2.el9_0.x86_64.rpm libarchive-devel-3.5.3-2.el9_0.i686.rpm libarchive-devel-3.5.3-2.el9_0.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2022:5252-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:5252
Issued Date: : 2022-06-28
CVE Names: CVE-2022-26280

Topic

An update for libarchive is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impactofModerate. A Common Vulnerability Scoring System (CVSS) base score, whichgives adetailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

Relevant Releases Architectures

Red Hat CodeReady Linux Builder (v. 9) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux BaseOS (v. 9) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

2071931 - CVE-2022-26280 libarchive: an out-of-bounds read via the component zipx_lzma_alone_init

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.