Synopsis

Moderate: libarchive security and bug fix update

Type/Severity

Security Advisory: Moderate

Topic

An update for libarchive is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: Double free in RAR decoder resulting in a denial of service (CVE-2018-1000877)
  
• libarchive: Use after free in RAR decoder resulting in a denial of service (CVE-2018-1000878)
  
• libarchive: Out of bounds read in archive_read_support_format_7zip.c resulting in a denial of service (CVE-2019-1000019)
  
• libarchive: Infinite recursion in archive_read_support_format_iso9660.c resulting in denial of service (CVE-2019-1000020)
  
• libarchive: Out-of-bounds read in lha_read_data_none (CVE-2017-14503)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

• BZ - 1494449 - CVE-2017-14503 libarchive: Out-of-bounds read in lha_read_data_none
• BZ - 1663887 - CVE-2018-1000877 libarchive: Double free in RAR decoder resulting in a denial of service
• BZ - 1663889 - CVE-2018-1000878 libarchive: Use after free in RAR decoder resulting in a denial of service
• BZ - 1672888 - CVE-2019-1000020 libarchive: Infinite recursion in archive_read_support_format_iso9660.c resulting in denial of service
• BZ - 1672892 - CVE-2019-1000019 libarchive: Out of bounds read in archive_read_support_format_7zip.c resulting in a denial of service

CVEs

• CVE-2017-14503
• CVE-2018-1000877
• CVE-2018-1000878
• CVE-2019-1000019
• CVE-2019-1000020

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/

Red Hat Enterprise Linux for x86_64 8

SRPM
libarchive-3.3.2-7.el8.src.rpm	SHA-256: 8b16d27ab3eb66096db0af86777a28d5d0501ebeef46552ce369a4d5a47337dd
x86_64
bsdcat-debuginfo-3.3.2-7.el8.i686.rpm	SHA-256: 602d59b31011195b53661aa4ce242453554a79474dedab8f2685ef1b783feab7
bsdcat-debuginfo-3.3.2-7.el8.x86_64.rpm	SHA-256: d3d41fb668ba5429765279edad38ca848ea7d41d13230188558274cddb34da00
bsdcpio-debuginfo-3.3.2-7.el8.i686.rpm	SHA-256: 8d21459982636a34732f5583295530a17dac8bf9df85c1460d57a9007ef76f1a
bsdcpio-debuginfo-3.3.2-7.el8.x86_64.rpm	SHA-256: 7830310438b8fa56b0ea4e5d97e01fa3e3935da029f3ffe52d78efb3dadb46a1
bsdtar-3.3.2-7.el8.x86_64.rpm	SHA-256: 521df69e4e172985125c889421a64b812d5ccba4481de68be618fa069e496c26
bsdtar-debuginfo-3.3.2-7.el8.i686.rpm	SHA-256: b65f161c1a4f5b21735016ec837e1c461c79d7f74a774388b44b5d4bbf6833e6
bsdtar-debuginfo-3.3.2-7.el8.x86_64.rpm	SHA-256: f125416ed0c57d2160fb767aa1df106a1c404992a1ee99f3138b879631735aab
libarchive-3.3.2-7.el8.i686.rpm	SHA-256: 7aaaaff36bd8b70771a1c90534900d5d288c76fb201db51fc5b60f3919df331d
libarchive-3.3.2-7.el8.x86_64.rpm	SHA-256: 93c7c066f9b8aa2c36bbce5092bcc3ffaa5b8001b8069487b5b3e8e1e225dfd9
libarchive-debuginfo-3.3.2-7.el8.i686.rpm	SHA-256: e1c517982c90cee6cfd572e5c559022dc0d5336bfed520590aa9d65c6235ce43
libarchive-debuginfo-3.3.2-7.el8.x86_64.rpm	SHA-256: e9917f0594c5cf18411c6fc547e3866975e0d122c0dcc23e23ffb7fa1bdc9b91
libarchive-debugsource-3.3.2-7.el8.i686.rpm	SHA-256: 716e90feee7f49f98254aaedd321e750ff0228324d42ceef6bf191c9420ef8ba
libarchive-debugsource-3.3.2-7.el8.x86_64.rpm	SHA-256: 2308871eee3abc01cd3a4aec57116e604669afffb708f701133d0ba8990757e0

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
libarchive-3.3.2-7.el8.src.rpm	SHA-256: 8b16d27ab3eb66096db0af86777a28d5d0501ebeef46552ce369a4d5a47337dd
s390x
bsdcat-debuginfo-3.3.2-7.el8.s390x.rpm	SHA-256: 6e6a077e952f31a7134e398925e39d225ffda397e41c813c7fde4a7637adf691
bsdcpio-debuginfo-3.3.2-7.el8.s390x.rpm	SHA-256: fed48a3ef89e11cfab7fe26cdccb17fa90d815935afd81739ee5cfcee07f1915
bsdtar-3.3.2-7.el8.s390x.rpm	SHA-256: 9023c8a605b396af0ccf7a3dd3385a39a02c14ce6979231c60cccdf620bbff23
bsdtar-debuginfo-3.3.2-7.el8.s390x.rpm	SHA-256: d2398301ed04cfb29996cd860b403a7572362ce3de44275b1e19c182c7834c2b
libarchive-3.3.2-7.el8.s390x.rpm	SHA-256: 684ed64bc91014de65183a4a978eb450804fede7d551a4ded0747ac15e817fbd
libarchive-debuginfo-3.3.2-7.el8.s390x.rpm	SHA-256: 141faf449144c0572d1a2ce3e1873803355db915625060320bba94d286a989e9
libarchive-debugsource-3.3.2-7.el8.s390x.rpm	SHA-256: 82869f156ae5767b668709f260954e68d222571804461548ea641735e1b8df2a

Red Hat Enterprise Linux for Power, little endian 8

SRPM
libarchive-3.3.2-7.el8.src.rpm	SHA-256: 8b16d27ab3eb66096db0af86777a28d5d0501ebeef46552ce369a4d5a47337dd
ppc64le
bsdcat-debuginfo-3.3.2-7.el8.ppc64le.rpm	SHA-256: ff31c2d6a88b4a41db19b93a8f8e5cc08215809a256c908f0374464255c7971a
bsdcpio-debuginfo-3.3.2-7.el8.ppc64le.rpm	SHA-256: 38e29c4e021df33c16dbe9f0c50dde6f6ed1cd6b9be4dc9c15a0d9088ebd779d
bsdtar-3.3.2-7.el8.ppc64le.rpm	SHA-256: bbe538a178d7dbda116de42a24977342cdabfbccec394471052eb1e70b5f7572
bsdtar-debuginfo-3.3.2-7.el8.ppc64le.rpm	SHA-256: c647d2e33d114f711958512831d345efa782f57935374eec4a215ba463c9fe21
libarchive-3.3.2-7.el8.ppc64le.rpm	SHA-256: eb2559162f8bc3afb6f584ff4ee5abaed7a7afd450fec6fea05a638293998b00
libarchive-debuginfo-3.3.2-7.el8.ppc64le.rpm	SHA-256: 5f2a48cf4b785464eb35cd3f3af1f7ce3c45b3aafc99cb840ee210cc3088f532
libarchive-debugsource-3.3.2-7.el8.ppc64le.rpm	SHA-256: e3dbf10c7a2ef3038451039be79f49c81dd6d36df3f18d2a34baa963301ca7a6

Red Hat Enterprise Linux for ARM 64 8

SRPM
libarchive-3.3.2-7.el8.src.rpm	SHA-256: 8b16d27ab3eb66096db0af86777a28d5d0501ebeef46552ce369a4d5a47337dd
aarch64
bsdcat-debuginfo-3.3.2-7.el8.aarch64.rpm	SHA-256: 61f83a6cc0bfe602d2882845de00faf0e3efe24daa015bdacd7c6b2b508f0438
bsdcpio-debuginfo-3.3.2-7.el8.aarch64.rpm	SHA-256: 42a2a839e3a786d5ae852f6a923e7b73b9f7d96d339976e3d46952b528b7ae65
bsdtar-3.3.2-7.el8.aarch64.rpm	SHA-256: 7770212e0eb218c7031cc805ffb6d42bce63c98ba90186cf4aa8e8e6c9429b72
bsdtar-debuginfo-3.3.2-7.el8.aarch64.rpm	SHA-256: 9d4ebfba009817faf7ffb839218065213a65455c888200ffbcb9bba498df7b85
libarchive-3.3.2-7.el8.aarch64.rpm	SHA-256: 97cafb25ede3adb2d385120553e18a5046d1677fffe2ebd33d5140aecad928ba
libarchive-debuginfo-3.3.2-7.el8.aarch64.rpm	SHA-256: c80757a3632ff4c7a65ba669c73276e6baaf0ca7f16a3d2a646789147889f383
libarchive-debugsource-3.3.2-7.el8.aarch64.rpm	SHA-256: 3442d5b89f5d32192eab3cf6e92ef7ad7e258df847b90da4ab7c4f5ba928deaf

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
bsdcat-debuginfo-3.3.2-7.el8.i686.rpm	SHA-256: 602d59b31011195b53661aa4ce242453554a79474dedab8f2685ef1b783feab7
bsdcat-debuginfo-3.3.2-7.el8.x86_64.rpm	SHA-256: d3d41fb668ba5429765279edad38ca848ea7d41d13230188558274cddb34da00
bsdcpio-debuginfo-3.3.2-7.el8.i686.rpm	SHA-256: 8d21459982636a34732f5583295530a17dac8bf9df85c1460d57a9007ef76f1a
bsdcpio-debuginfo-3.3.2-7.el8.x86_64.rpm	SHA-256: 7830310438b8fa56b0ea4e5d97e01fa3e3935da029f3ffe52d78efb3dadb46a1
bsdtar-debuginfo-3.3.2-7.el8.i686.rpm	SHA-256: b65f161c1a4f5b21735016ec837e1c461c79d7f74a774388b44b5d4bbf6833e6
bsdtar-debuginfo-3.3.2-7.el8.x86_64.rpm	SHA-256: f125416ed0c57d2160fb767aa1df106a1c404992a1ee99f3138b879631735aab
libarchive-debuginfo-3.3.2-7.el8.i686.rpm	SHA-256: e1c517982c90cee6cfd572e5c559022dc0d5336bfed520590aa9d65c6235ce43
libarchive-debuginfo-3.3.2-7.el8.x86_64.rpm	SHA-256: e9917f0594c5cf18411c6fc547e3866975e0d122c0dcc23e23ffb7fa1bdc9b91
libarchive-debugsource-3.3.2-7.el8.i686.rpm	SHA-256: 716e90feee7f49f98254aaedd321e750ff0228324d42ceef6bf191c9420ef8ba
libarchive-debugsource-3.3.2-7.el8.x86_64.rpm	SHA-256: 2308871eee3abc01cd3a4aec57116e604669afffb708f701133d0ba8990757e0
libarchive-devel-3.3.2-7.el8.i686.rpm	SHA-256: da6040f2601a6fa740939de1da221cc95fdd51e324d5c88d730b237e8bf61a63
libarchive-devel-3.3.2-7.el8.x86_64.rpm	SHA-256: 14e4784cb0f9f406da61cc7bb080337a5ca631789ffffe08d52de4e1ec6caf1f

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
bsdcat-debuginfo-3.3.2-7.el8.ppc64le.rpm	SHA-256: ff31c2d6a88b4a41db19b93a8f8e5cc08215809a256c908f0374464255c7971a
bsdcpio-debuginfo-3.3.2-7.el8.ppc64le.rpm	SHA-256: 38e29c4e021df33c16dbe9f0c50dde6f6ed1cd6b9be4dc9c15a0d9088ebd779d
bsdtar-debuginfo-3.3.2-7.el8.ppc64le.rpm	SHA-256: c647d2e33d114f711958512831d345efa782f57935374eec4a215ba463c9fe21
libarchive-debuginfo-3.3.2-7.el8.ppc64le.rpm	SHA-256: 5f2a48cf4b785464eb35cd3f3af1f7ce3c45b3aafc99cb840ee210cc3088f532
libarchive-debugsource-3.3.2-7.el8.ppc64le.rpm	SHA-256: e3dbf10c7a2ef3038451039be79f49c81dd6d36df3f18d2a34baa963301ca7a6
libarchive-devel-3.3.2-7.el8.ppc64le.rpm	SHA-256: 6a10c19b53ec55c967d0a49fd2fcb6f26f2118deb652694066771fc7d36b8b28

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
bsdcat-debuginfo-3.3.2-7.el8.aarch64.rpm	SHA-256: 61f83a6cc0bfe602d2882845de00faf0e3efe24daa015bdacd7c6b2b508f0438
bsdcpio-debuginfo-3.3.2-7.el8.aarch64.rpm	SHA-256: 42a2a839e3a786d5ae852f6a923e7b73b9f7d96d339976e3d46952b528b7ae65
bsdtar-debuginfo-3.3.2-7.el8.aarch64.rpm	SHA-256: 9d4ebfba009817faf7ffb839218065213a65455c888200ffbcb9bba498df7b85
libarchive-debuginfo-3.3.2-7.el8.aarch64.rpm	SHA-256: c80757a3632ff4c7a65ba669c73276e6baaf0ca7f16a3d2a646789147889f383
libarchive-debugsource-3.3.2-7.el8.aarch64.rpm	SHA-256: 3442d5b89f5d32192eab3cf6e92ef7ad7e258df847b90da4ab7c4f5ba928deaf
libarchive-devel-3.3.2-7.el8.aarch64.rpm	SHA-256: 9508596bf68c6e3e2023fad47cf5efae96429ebd4392a2dae52c5ba1dc8d6f1f

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
bsdcat-debuginfo-3.3.2-7.el8.s390x.rpm	SHA-256: 6e6a077e952f31a7134e398925e39d225ffda397e41c813c7fde4a7637adf691
bsdcpio-debuginfo-3.3.2-7.el8.s390x.rpm	SHA-256: fed48a3ef89e11cfab7fe26cdccb17fa90d815935afd81739ee5cfcee07f1915
bsdtar-debuginfo-3.3.2-7.el8.s390x.rpm	SHA-256: d2398301ed04cfb29996cd860b403a7572362ce3de44275b1e19c182c7834c2b
libarchive-debuginfo-3.3.2-7.el8.s390x.rpm	SHA-256: 141faf449144c0572d1a2ce3e1873803355db915625060320bba94d286a989e9
libarchive-debugsource-3.3.2-7.el8.s390x.rpm	SHA-256: 82869f156ae5767b668709f260954e68d222571804461548ea641735e1b8df2a
libarchive-devel-3.3.2-7.el8.s390x.rpm	SHA-256: 8b72dfd6924af5d87a8eef7d9990ec57018ca4dc73e65c4e48c96b55a8801fe8