-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Low: libarchive security update
Advisory ID:       RHSA-2023:3018-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3018
Issue date:        2023-05-16
CVE Names:         CVE-2022-36227 
====================================================================
1. Summary:

An update for libarchive is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux CRB (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

The libarchive programming library can create and read several different
streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM
images. Libarchive is used notably in the bsdtar utility, scripting
language bindings such as python-libarchive, and several popular desktop
file managers.

Security Fix(es):

* libarchive: NULL pointer dereference in archive_write.c (CVE-2022-36227)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.8 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2144972 - CVE-2022-36227 libarchive: NULL pointer dereference in archive_write.c

6. Package List:

Red Hat Enterprise Linux BaseOS (v. 8):

Source:
libarchive-3.3.3-5.el8.src.rpm

aarch64:
bsdcat-debuginfo-3.3.3-5.el8.aarch64.rpm
bsdcpio-debuginfo-3.3.3-5.el8.aarch64.rpm
bsdtar-3.3.3-5.el8.aarch64.rpm
bsdtar-debuginfo-3.3.3-5.el8.aarch64.rpm
libarchive-3.3.3-5.el8.aarch64.rpm
libarchive-debuginfo-3.3.3-5.el8.aarch64.rpm
libarchive-debugsource-3.3.3-5.el8.aarch64.rpm

ppc64le:
bsdcat-debuginfo-3.3.3-5.el8.ppc64le.rpm
bsdcpio-debuginfo-3.3.3-5.el8.ppc64le.rpm
bsdtar-3.3.3-5.el8.ppc64le.rpm
bsdtar-debuginfo-3.3.3-5.el8.ppc64le.rpm
libarchive-3.3.3-5.el8.ppc64le.rpm
libarchive-debuginfo-3.3.3-5.el8.ppc64le.rpm
libarchive-debugsource-3.3.3-5.el8.ppc64le.rpm

s390x:
bsdcat-debuginfo-3.3.3-5.el8.s390x.rpm
bsdcpio-debuginfo-3.3.3-5.el8.s390x.rpm
bsdtar-3.3.3-5.el8.s390x.rpm
bsdtar-debuginfo-3.3.3-5.el8.s390x.rpm
libarchive-3.3.3-5.el8.s390x.rpm
libarchive-debuginfo-3.3.3-5.el8.s390x.rpm
libarchive-debugsource-3.3.3-5.el8.s390x.rpm

x86_64:
bsdcat-debuginfo-3.3.3-5.el8.i686.rpm
bsdcat-debuginfo-3.3.3-5.el8.x86_64.rpm
bsdcpio-debuginfo-3.3.3-5.el8.i686.rpm
bsdcpio-debuginfo-3.3.3-5.el8.x86_64.rpm
bsdtar-3.3.3-5.el8.x86_64.rpm
bsdtar-debuginfo-3.3.3-5.el8.i686.rpm
bsdtar-debuginfo-3.3.3-5.el8.x86_64.rpm
libarchive-3.3.3-5.el8.i686.rpm
libarchive-3.3.3-5.el8.x86_64.rpm
libarchive-debuginfo-3.3.3-5.el8.i686.rpm
libarchive-debuginfo-3.3.3-5.el8.x86_64.rpm
libarchive-debugsource-3.3.3-5.el8.i686.rpm
libarchive-debugsource-3.3.3-5.el8.x86_64.rpm

Red Hat Enterprise Linux CRB (v. 8):

aarch64:
bsdcat-debuginfo-3.3.3-5.el8.aarch64.rpm
bsdcpio-debuginfo-3.3.3-5.el8.aarch64.rpm
bsdtar-debuginfo-3.3.3-5.el8.aarch64.rpm
libarchive-debuginfo-3.3.3-5.el8.aarch64.rpm
libarchive-debugsource-3.3.3-5.el8.aarch64.rpm
libarchive-devel-3.3.3-5.el8.aarch64.rpm

ppc64le:
bsdcat-debuginfo-3.3.3-5.el8.ppc64le.rpm
bsdcpio-debuginfo-3.3.3-5.el8.ppc64le.rpm
bsdtar-debuginfo-3.3.3-5.el8.ppc64le.rpm
libarchive-debuginfo-3.3.3-5.el8.ppc64le.rpm
libarchive-debugsource-3.3.3-5.el8.ppc64le.rpm
libarchive-devel-3.3.3-5.el8.ppc64le.rpm

s390x:
bsdcat-debuginfo-3.3.3-5.el8.s390x.rpm
bsdcpio-debuginfo-3.3.3-5.el8.s390x.rpm
bsdtar-debuginfo-3.3.3-5.el8.s390x.rpm
libarchive-debuginfo-3.3.3-5.el8.s390x.rpm
libarchive-debugsource-3.3.3-5.el8.s390x.rpm
libarchive-devel-3.3.3-5.el8.s390x.rpm

x86_64:
bsdcat-debuginfo-3.3.3-5.el8.i686.rpm
bsdcat-debuginfo-3.3.3-5.el8.x86_64.rpm
bsdcpio-debuginfo-3.3.3-5.el8.i686.rpm
bsdcpio-debuginfo-3.3.3-5.el8.x86_64.rpm
bsdtar-debuginfo-3.3.3-5.el8.i686.rpm
bsdtar-debuginfo-3.3.3-5.el8.x86_64.rpm
libarchive-debuginfo-3.3.3-5.el8.i686.rpm
libarchive-debuginfo-3.3.3-5.el8.x86_64.rpm
libarchive-debugsource-3.3.3-5.el8.i686.rpm
libarchive-debugsource-3.3.3-5.el8.x86_64.rpm
libarchive-devel-3.3.3-5.el8.i686.rpm
libarchive-devel-3.3.3-5.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-36227
https://access.redhat.com/security/updates/classification/#low
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBZGNu4NzjgjWX9erEAQjWcA//YUaCE7SG3uFRBXca8rEzmr4xNxLjorNt
kFyrAYcXBtTdYKEjfM9lBy1S86o4neH6q3ImwQWXTRLPsWQatLXOGQczQHHIku+H
c0Wc0psTE8KfWQsm1bUPNfHvfEAoy5o41pgOQTmBywON/lIi2n9Ru91zjQSCWOK8
NDplGdnl7fifvJ4KGgTYbj1BG4VYt/JG0/7+jlmu9y+a/iuz1fTIdGIt7aZvOQR4
NfYNZiJ81gT9UH5m0+xWzHgHSuAs8WfC/CMh9ljdhtrW2YBb2iHvetiGuIz0A9XQ
MSE9tHMSPkLLGvEU1IWyUSavpV1S9MpgHfWdYR3K/W0gkLK+gG4cY9/jqZfR42i3
0Xv1WVsTXpz4f5yxnL/3N3kqu0i3I9LJ6l2v8VhY55jl2aIaePwWmilmtKsiqAa+
HG8MsGCiRYVbl6iXUMFD4qrsjfNV1+Q5QjB1BI0vy6sGzLZ/0t7fkz2+qMDqgsxu
UCfbklgWZTD/xWAKlhg0uYTYUynA7XkNCHui9+FQ025qtLUSWYsp6UwPdTEXNJRk
4+3SuLU8D2y8v7UDYR5zZqWnACilUO77W8j8trfWVVUuh6G2oWdUcWrSJSEOixPv
oK1seVZ8B43A9hmKAbYs386oNZ4txyJT5AGLBIJcnLocWHycy0NVinLERWdOz16+
ljnjGZAFlCI=6MQ9
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2023-3018:01 Low: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 8

Summary

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.
Security Fix(es):
* libarchive: NULL pointer dereference in archive_write.c (CVE-2022-36227)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2022-36227 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index

Package List

Red Hat Enterprise Linux BaseOS (v. 8):
Source: libarchive-3.3.3-5.el8.src.rpm
aarch64: bsdcat-debuginfo-3.3.3-5.el8.aarch64.rpm bsdcpio-debuginfo-3.3.3-5.el8.aarch64.rpm bsdtar-3.3.3-5.el8.aarch64.rpm bsdtar-debuginfo-3.3.3-5.el8.aarch64.rpm libarchive-3.3.3-5.el8.aarch64.rpm libarchive-debuginfo-3.3.3-5.el8.aarch64.rpm libarchive-debugsource-3.3.3-5.el8.aarch64.rpm
ppc64le: bsdcat-debuginfo-3.3.3-5.el8.ppc64le.rpm bsdcpio-debuginfo-3.3.3-5.el8.ppc64le.rpm bsdtar-3.3.3-5.el8.ppc64le.rpm bsdtar-debuginfo-3.3.3-5.el8.ppc64le.rpm libarchive-3.3.3-5.el8.ppc64le.rpm libarchive-debuginfo-3.3.3-5.el8.ppc64le.rpm libarchive-debugsource-3.3.3-5.el8.ppc64le.rpm
s390x: bsdcat-debuginfo-3.3.3-5.el8.s390x.rpm bsdcpio-debuginfo-3.3.3-5.el8.s390x.rpm bsdtar-3.3.3-5.el8.s390x.rpm bsdtar-debuginfo-3.3.3-5.el8.s390x.rpm libarchive-3.3.3-5.el8.s390x.rpm libarchive-debuginfo-3.3.3-5.el8.s390x.rpm libarchive-debugsource-3.3.3-5.el8.s390x.rpm
x86_64: bsdcat-debuginfo-3.3.3-5.el8.i686.rpm bsdcat-debuginfo-3.3.3-5.el8.x86_64.rpm bsdcpio-debuginfo-3.3.3-5.el8.i686.rpm bsdcpio-debuginfo-3.3.3-5.el8.x86_64.rpm bsdtar-3.3.3-5.el8.x86_64.rpm bsdtar-debuginfo-3.3.3-5.el8.i686.rpm bsdtar-debuginfo-3.3.3-5.el8.x86_64.rpm libarchive-3.3.3-5.el8.i686.rpm libarchive-3.3.3-5.el8.x86_64.rpm libarchive-debuginfo-3.3.3-5.el8.i686.rpm libarchive-debuginfo-3.3.3-5.el8.x86_64.rpm libarchive-debugsource-3.3.3-5.el8.i686.rpm libarchive-debugsource-3.3.3-5.el8.x86_64.rpm
Red Hat Enterprise Linux CRB (v. 8):
aarch64: bsdcat-debuginfo-3.3.3-5.el8.aarch64.rpm bsdcpio-debuginfo-3.3.3-5.el8.aarch64.rpm bsdtar-debuginfo-3.3.3-5.el8.aarch64.rpm libarchive-debuginfo-3.3.3-5.el8.aarch64.rpm libarchive-debugsource-3.3.3-5.el8.aarch64.rpm libarchive-devel-3.3.3-5.el8.aarch64.rpm
ppc64le: bsdcat-debuginfo-3.3.3-5.el8.ppc64le.rpm bsdcpio-debuginfo-3.3.3-5.el8.ppc64le.rpm bsdtar-debuginfo-3.3.3-5.el8.ppc64le.rpm libarchive-debuginfo-3.3.3-5.el8.ppc64le.rpm libarchive-debugsource-3.3.3-5.el8.ppc64le.rpm libarchive-devel-3.3.3-5.el8.ppc64le.rpm
s390x: bsdcat-debuginfo-3.3.3-5.el8.s390x.rpm bsdcpio-debuginfo-3.3.3-5.el8.s390x.rpm bsdtar-debuginfo-3.3.3-5.el8.s390x.rpm libarchive-debuginfo-3.3.3-5.el8.s390x.rpm libarchive-debugsource-3.3.3-5.el8.s390x.rpm libarchive-devel-3.3.3-5.el8.s390x.rpm
x86_64: bsdcat-debuginfo-3.3.3-5.el8.i686.rpm bsdcat-debuginfo-3.3.3-5.el8.x86_64.rpm bsdcpio-debuginfo-3.3.3-5.el8.i686.rpm bsdcpio-debuginfo-3.3.3-5.el8.x86_64.rpm bsdtar-debuginfo-3.3.3-5.el8.i686.rpm bsdtar-debuginfo-3.3.3-5.el8.x86_64.rpm libarchive-debuginfo-3.3.3-5.el8.i686.rpm libarchive-debuginfo-3.3.3-5.el8.x86_64.rpm libarchive-debugsource-3.3.3-5.el8.i686.rpm libarchive-debugsource-3.3.3-5.el8.x86_64.rpm libarchive-devel-3.3.3-5.el8.i686.rpm libarchive-devel-3.3.3-5.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2023:3018-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:3018
Issued Date: : 2023-05-16
CVE Names: CVE-2022-36227

Topic

An update for libarchive is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Low. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux CRB (v. 8) - aarch64, ppc64le, s390x, x86_64


Bugs Fixed

2144972 - CVE-2022-36227 libarchive: NULL pointer dereference in archive_write.c


Related News

Google Releases Chrome 130 with Critical Security Fixes for 17 Flaws
3 - 5 min read
Google recently unveiled Chrome 130 , an update that addresses several security vulnerabilities to ensure the web browser's safety and reliability.
U.S. Investigation into China-Backed Telecom Companies Hack: The Role & Risks of Encryption Backdoors
3 - 5 min read
U.S. authorities are on high alert as they investigate an alleged Chinese state-sponsored hack targeting major U.S. telecommunications companies.
FASTCash Linux Malware: A New Cybercrime Menace Targeting Payment Switch Systems
3 - 5 min read
As malware threats evolve to increasingly target Linux systems, admins and organizations must stay up-to-date on the latest Linux malware variants
Optimizing CWPP on Linux Servers: Best Practices and Configurations
3 - 6 min read
Cloud Workload Protection Platforms are now essential for securing virtual environments. These provide a robust security layer vital for addressing
The Infiltration of Supply Chain Attacks in Open-Source Software Management
3 - 6 min read
Open-source projects are renowned for their collaborative nature and widespread adoption, yet more sophisticated supply chain attacks target them
Strengthen Your Linux Software Development Pipeline with Code Security Scanners
3 - 6 min read
Developers recognize the critical nature of protecting software systems as cyberattacks grow more sophisticated, thus necessitating robust security
Everything You Need to Know About Cloud Security Posture Management
3 - 5 min read
Many companies are transitioning from physical servers to cloud operations, but this transformation brings new challenges. Cloud Security Posture
Understanding the Critical Oath-Toolkit Vulnerability and Its Implications for Admins
3 - 5 min read
As Linux security threats advance and evolve, vulnerabilities often surface unexpectedly, exposing systems to potential exploitation. SUSE

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved