Issued:
2022-06-13
Updated:
2022-06-13

RHSA-2022:4993 - Security Advisory

Synopsis

Important: xz security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for xz is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.

Security Fix(es):

  • gzip: arbitrary-file-write vulnerability (CVE-2022-1271)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
  • Red Hat Enterprise Linux Server - AUS 8.4 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.4 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
  • Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.4 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.4 ppc64le
  • Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.4 s390x
  • Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.4 aarch64

Fixes

  • BZ - 2073310 - CVE-2022-1271 gzip: arbitrary-file-write vulnerability

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4

SRPM
xz-5.2.4-4.el8_4.src.rpm SHA-256: c47781aa0a99873efa9cd64e23bfc1431ad01bae73c1aa1379789d4ce8568e70
x86_64
xz-5.2.4-4.el8_4.x86_64.rpm SHA-256: e1c2871a7bd76bc75766c3b37dedd572f4bd0e157ec1f8755bb66fe0518a4492
xz-debuginfo-5.2.4-4.el8_4.i686.rpm SHA-256: 87f3758dabd04de95d85800d3909bd08a64bb4528372049f7bf881c7f079a425
xz-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 2b33586045fc9863fa5e30a5d00fff63e92c28e306a6cc1447e7893e1e4ab3f9
xz-debugsource-5.2.4-4.el8_4.i686.rpm SHA-256: 404663121fd3750a52f808b10ae41c2a41404f3e16d96d70f159bfdf4b4fb6b5
xz-debugsource-5.2.4-4.el8_4.x86_64.rpm SHA-256: 6833d4d8d09b712065fd7eddbe80e6cdd82f40b75dd876b22344ba13332e393d
xz-devel-5.2.4-4.el8_4.i686.rpm SHA-256: 50aede167a60530c2eb65ef07eed2a395037957431fd2884a053313d546bc5ec
xz-devel-5.2.4-4.el8_4.x86_64.rpm SHA-256: 33c1a56939845360d7a877d82450d784410cba34f5fc7a3ab9e740ab69d5c170
xz-libs-5.2.4-4.el8_4.i686.rpm SHA-256: 4379316f845cd342a8890b4badf5af7670b04b3e28bf9af1af0a52f3bfaf8afd
xz-libs-5.2.4-4.el8_4.x86_64.rpm SHA-256: 56a96c8dba257dc1b52a2bc99683f3f744060fb9faa7df1dca6f8b5528300e6e
xz-libs-debuginfo-5.2.4-4.el8_4.i686.rpm SHA-256: c3b1e8a85aec2736ceb340df6fce45f70a529cd61c6f4273c3a75d555628181a
xz-libs-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 2855427d2e9c7a438dfa275bd07dd087ba93cba00ee898f3fe348ccc35dbd12c
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.i686.rpm SHA-256: a0cbc00209a1de6394b1f15095409b52354fef6ceb3070a49303e0b82d89846d
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 8348211c6815ec8a9ddb68af5e191be5b5b55688217bddfe138361038ffa9dd5

Red Hat Enterprise Linux Server - AUS 8.4

SRPM
xz-5.2.4-4.el8_4.src.rpm SHA-256: c47781aa0a99873efa9cd64e23bfc1431ad01bae73c1aa1379789d4ce8568e70
x86_64
xz-5.2.4-4.el8_4.x86_64.rpm SHA-256: e1c2871a7bd76bc75766c3b37dedd572f4bd0e157ec1f8755bb66fe0518a4492
xz-debuginfo-5.2.4-4.el8_4.i686.rpm SHA-256: 87f3758dabd04de95d85800d3909bd08a64bb4528372049f7bf881c7f079a425
xz-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 2b33586045fc9863fa5e30a5d00fff63e92c28e306a6cc1447e7893e1e4ab3f9
xz-debugsource-5.2.4-4.el8_4.i686.rpm SHA-256: 404663121fd3750a52f808b10ae41c2a41404f3e16d96d70f159bfdf4b4fb6b5
xz-debugsource-5.2.4-4.el8_4.x86_64.rpm SHA-256: 6833d4d8d09b712065fd7eddbe80e6cdd82f40b75dd876b22344ba13332e393d
xz-devel-5.2.4-4.el8_4.i686.rpm SHA-256: 50aede167a60530c2eb65ef07eed2a395037957431fd2884a053313d546bc5ec
xz-devel-5.2.4-4.el8_4.x86_64.rpm SHA-256: 33c1a56939845360d7a877d82450d784410cba34f5fc7a3ab9e740ab69d5c170
xz-libs-5.2.4-4.el8_4.i686.rpm SHA-256: 4379316f845cd342a8890b4badf5af7670b04b3e28bf9af1af0a52f3bfaf8afd
xz-libs-5.2.4-4.el8_4.x86_64.rpm SHA-256: 56a96c8dba257dc1b52a2bc99683f3f744060fb9faa7df1dca6f8b5528300e6e
xz-libs-debuginfo-5.2.4-4.el8_4.i686.rpm SHA-256: c3b1e8a85aec2736ceb340df6fce45f70a529cd61c6f4273c3a75d555628181a
xz-libs-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 2855427d2e9c7a438dfa275bd07dd087ba93cba00ee898f3fe348ccc35dbd12c
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.i686.rpm SHA-256: a0cbc00209a1de6394b1f15095409b52354fef6ceb3070a49303e0b82d89846d
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 8348211c6815ec8a9ddb68af5e191be5b5b55688217bddfe138361038ffa9dd5

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4

SRPM
xz-5.2.4-4.el8_4.src.rpm SHA-256: c47781aa0a99873efa9cd64e23bfc1431ad01bae73c1aa1379789d4ce8568e70
s390x
xz-5.2.4-4.el8_4.s390x.rpm SHA-256: 525524b0caf11a23654449b25888c0de009974d85dfa3f1ad7c1bfd1960299d0
xz-debuginfo-5.2.4-4.el8_4.s390x.rpm SHA-256: 96d194251d41be9b55ab40986d6fec4861aeb084124ae16fd4908473b0060e55
xz-debugsource-5.2.4-4.el8_4.s390x.rpm SHA-256: 37e93a187e9135f092dffdf5940962543d0a4fbc112a8ec18ea7672fefe65793
xz-devel-5.2.4-4.el8_4.s390x.rpm SHA-256: a41dfab457fdbb7183f3face5d63c62a86309f7a0d2a662c62b7d4b2e6a73a9b
xz-libs-5.2.4-4.el8_4.s390x.rpm SHA-256: d1b304220a5b0cb0b7ddb5889b5a2ee948ccb792be3c43bdd8fe00740478bf3b
xz-libs-debuginfo-5.2.4-4.el8_4.s390x.rpm SHA-256: 3be3af18a311d68f457eed593074c86a7c8008e3a31a824ba20e21329b3d33d2
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.s390x.rpm SHA-256: 6b2a6a090e4f7577d9ffeb73fc5ce2dd1705b93b20291d51744231cd52dc4e23

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4

SRPM
xz-5.2.4-4.el8_4.src.rpm SHA-256: c47781aa0a99873efa9cd64e23bfc1431ad01bae73c1aa1379789d4ce8568e70
ppc64le
xz-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 210f5ba4fa097f2d9c94ed144ef40336c98a66194e0f9055db2d17724286c975
xz-debuginfo-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 717cd2b625bf6f40e6c21f143473f40125ec10c00aa5e84013c3175e2f7b9e69
xz-debugsource-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 1c6864c13ed863088a0766eb79e1bfe185f79679b222676d02badddfa5dfd010
xz-devel-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 548ad5507aa6b06eada413547a12b89800a15e33ea7ab53daf12bbfc22735348
xz-libs-5.2.4-4.el8_4.ppc64le.rpm SHA-256: b84e4681b9407bb0510fb016f406062f7fc9686b5719f8f43a67bc7f6b9b971b
xz-libs-debuginfo-5.2.4-4.el8_4.ppc64le.rpm SHA-256: d1299cc8502d7fac395beb9cd8e8ad18a869e7251c89aa1f9a3a3bcdcb837c44
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 2a496815e2b0b174ff6861cd587aa7a09254c01d017547ff46f36ec95ac3797c

Red Hat Enterprise Linux Server - TUS 8.4

SRPM
xz-5.2.4-4.el8_4.src.rpm SHA-256: c47781aa0a99873efa9cd64e23bfc1431ad01bae73c1aa1379789d4ce8568e70
x86_64
xz-5.2.4-4.el8_4.x86_64.rpm SHA-256: e1c2871a7bd76bc75766c3b37dedd572f4bd0e157ec1f8755bb66fe0518a4492
xz-debuginfo-5.2.4-4.el8_4.i686.rpm SHA-256: 87f3758dabd04de95d85800d3909bd08a64bb4528372049f7bf881c7f079a425
xz-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 2b33586045fc9863fa5e30a5d00fff63e92c28e306a6cc1447e7893e1e4ab3f9
xz-debugsource-5.2.4-4.el8_4.i686.rpm SHA-256: 404663121fd3750a52f808b10ae41c2a41404f3e16d96d70f159bfdf4b4fb6b5
xz-debugsource-5.2.4-4.el8_4.x86_64.rpm SHA-256: 6833d4d8d09b712065fd7eddbe80e6cdd82f40b75dd876b22344ba13332e393d
xz-devel-5.2.4-4.el8_4.i686.rpm SHA-256: 50aede167a60530c2eb65ef07eed2a395037957431fd2884a053313d546bc5ec
xz-devel-5.2.4-4.el8_4.x86_64.rpm SHA-256: 33c1a56939845360d7a877d82450d784410cba34f5fc7a3ab9e740ab69d5c170
xz-libs-5.2.4-4.el8_4.i686.rpm SHA-256: 4379316f845cd342a8890b4badf5af7670b04b3e28bf9af1af0a52f3bfaf8afd
xz-libs-5.2.4-4.el8_4.x86_64.rpm SHA-256: 56a96c8dba257dc1b52a2bc99683f3f744060fb9faa7df1dca6f8b5528300e6e
xz-libs-debuginfo-5.2.4-4.el8_4.i686.rpm SHA-256: c3b1e8a85aec2736ceb340df6fce45f70a529cd61c6f4273c3a75d555628181a
xz-libs-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 2855427d2e9c7a438dfa275bd07dd087ba93cba00ee898f3fe348ccc35dbd12c
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.i686.rpm SHA-256: a0cbc00209a1de6394b1f15095409b52354fef6ceb3070a49303e0b82d89846d
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 8348211c6815ec8a9ddb68af5e191be5b5b55688217bddfe138361038ffa9dd5

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4

SRPM
xz-5.2.4-4.el8_4.src.rpm SHA-256: c47781aa0a99873efa9cd64e23bfc1431ad01bae73c1aa1379789d4ce8568e70
aarch64
xz-5.2.4-4.el8_4.aarch64.rpm SHA-256: 0e6183848ed094f501b2dfcac6073b86f58cc0b43e92fa234c6b41aa068d5176
xz-debuginfo-5.2.4-4.el8_4.aarch64.rpm SHA-256: b391d963e561af11631451510a28964b178e7809db04279192fb3e81de8ef655
xz-debugsource-5.2.4-4.el8_4.aarch64.rpm SHA-256: 79db34cd21480e45dfb1bb019f57b44dbc2c9b380dec8c8244ae29bbbc4b32eb
xz-devel-5.2.4-4.el8_4.aarch64.rpm SHA-256: 9afe457ab8641b6a89edb6fc33330e9b158d66fa1d8dc1e718be7ca4efdb3ef9
xz-libs-5.2.4-4.el8_4.aarch64.rpm SHA-256: 99f71cddb6b027147e64a37f14a7a51e7be433a527f5062594a7564044cbf9d8
xz-libs-debuginfo-5.2.4-4.el8_4.aarch64.rpm SHA-256: 9b9ec211d41abb1995bbbb7dc3abd15c1d71a7676b221d5b091ebbcf9a600d12
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.aarch64.rpm SHA-256: 299af64241816265381525b98e90a464e2835a5958ea284be2f8ca8328f0f732

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4

SRPM
xz-5.2.4-4.el8_4.src.rpm SHA-256: c47781aa0a99873efa9cd64e23bfc1431ad01bae73c1aa1379789d4ce8568e70
ppc64le
xz-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 210f5ba4fa097f2d9c94ed144ef40336c98a66194e0f9055db2d17724286c975
xz-debuginfo-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 717cd2b625bf6f40e6c21f143473f40125ec10c00aa5e84013c3175e2f7b9e69
xz-debugsource-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 1c6864c13ed863088a0766eb79e1bfe185f79679b222676d02badddfa5dfd010
xz-devel-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 548ad5507aa6b06eada413547a12b89800a15e33ea7ab53daf12bbfc22735348
xz-libs-5.2.4-4.el8_4.ppc64le.rpm SHA-256: b84e4681b9407bb0510fb016f406062f7fc9686b5719f8f43a67bc7f6b9b971b
xz-libs-debuginfo-5.2.4-4.el8_4.ppc64le.rpm SHA-256: d1299cc8502d7fac395beb9cd8e8ad18a869e7251c89aa1f9a3a3bcdcb837c44
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 2a496815e2b0b174ff6861cd587aa7a09254c01d017547ff46f36ec95ac3797c

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4

SRPM
xz-5.2.4-4.el8_4.src.rpm SHA-256: c47781aa0a99873efa9cd64e23bfc1431ad01bae73c1aa1379789d4ce8568e70
x86_64
xz-5.2.4-4.el8_4.x86_64.rpm SHA-256: e1c2871a7bd76bc75766c3b37dedd572f4bd0e157ec1f8755bb66fe0518a4492
xz-debuginfo-5.2.4-4.el8_4.i686.rpm SHA-256: 87f3758dabd04de95d85800d3909bd08a64bb4528372049f7bf881c7f079a425
xz-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 2b33586045fc9863fa5e30a5d00fff63e92c28e306a6cc1447e7893e1e4ab3f9
xz-debugsource-5.2.4-4.el8_4.i686.rpm SHA-256: 404663121fd3750a52f808b10ae41c2a41404f3e16d96d70f159bfdf4b4fb6b5
xz-debugsource-5.2.4-4.el8_4.x86_64.rpm SHA-256: 6833d4d8d09b712065fd7eddbe80e6cdd82f40b75dd876b22344ba13332e393d
xz-devel-5.2.4-4.el8_4.i686.rpm SHA-256: 50aede167a60530c2eb65ef07eed2a395037957431fd2884a053313d546bc5ec
xz-devel-5.2.4-4.el8_4.x86_64.rpm SHA-256: 33c1a56939845360d7a877d82450d784410cba34f5fc7a3ab9e740ab69d5c170
xz-libs-5.2.4-4.el8_4.i686.rpm SHA-256: 4379316f845cd342a8890b4badf5af7670b04b3e28bf9af1af0a52f3bfaf8afd
xz-libs-5.2.4-4.el8_4.x86_64.rpm SHA-256: 56a96c8dba257dc1b52a2bc99683f3f744060fb9faa7df1dca6f8b5528300e6e
xz-libs-debuginfo-5.2.4-4.el8_4.i686.rpm SHA-256: c3b1e8a85aec2736ceb340df6fce45f70a529cd61c6f4273c3a75d555628181a
xz-libs-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 2855427d2e9c7a438dfa275bd07dd087ba93cba00ee898f3fe348ccc35dbd12c
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.i686.rpm SHA-256: a0cbc00209a1de6394b1f15095409b52354fef6ceb3070a49303e0b82d89846d
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 8348211c6815ec8a9ddb68af5e191be5b5b55688217bddfe138361038ffa9dd5

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.4

SRPM
x86_64
xz-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 2b33586045fc9863fa5e30a5d00fff63e92c28e306a6cc1447e7893e1e4ab3f9
xz-debugsource-5.2.4-4.el8_4.x86_64.rpm SHA-256: 6833d4d8d09b712065fd7eddbe80e6cdd82f40b75dd876b22344ba13332e393d
xz-libs-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 2855427d2e9c7a438dfa275bd07dd087ba93cba00ee898f3fe348ccc35dbd12c
xz-lzma-compat-5.2.4-4.el8_4.x86_64.rpm SHA-256: 6487a97f74d495ba5471f801a7ff6895aac7129b3aea84398004d4c8233baf7f
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.x86_64.rpm SHA-256: 8348211c6815ec8a9ddb68af5e191be5b5b55688217bddfe138361038ffa9dd5

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.4

SRPM
ppc64le
xz-debuginfo-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 717cd2b625bf6f40e6c21f143473f40125ec10c00aa5e84013c3175e2f7b9e69
xz-debugsource-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 1c6864c13ed863088a0766eb79e1bfe185f79679b222676d02badddfa5dfd010
xz-libs-debuginfo-5.2.4-4.el8_4.ppc64le.rpm SHA-256: d1299cc8502d7fac395beb9cd8e8ad18a869e7251c89aa1f9a3a3bcdcb837c44
xz-lzma-compat-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 15bf0fa4bf746ce83afb97fe108889b2e201f14478050956ed56ce82e892e399
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.ppc64le.rpm SHA-256: 2a496815e2b0b174ff6861cd587aa7a09254c01d017547ff46f36ec95ac3797c

Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.4

SRPM
s390x
xz-debuginfo-5.2.4-4.el8_4.s390x.rpm SHA-256: 96d194251d41be9b55ab40986d6fec4861aeb084124ae16fd4908473b0060e55
xz-debugsource-5.2.4-4.el8_4.s390x.rpm SHA-256: 37e93a187e9135f092dffdf5940962543d0a4fbc112a8ec18ea7672fefe65793
xz-libs-debuginfo-5.2.4-4.el8_4.s390x.rpm SHA-256: 3be3af18a311d68f457eed593074c86a7c8008e3a31a824ba20e21329b3d33d2
xz-lzma-compat-5.2.4-4.el8_4.s390x.rpm SHA-256: 06959d477c2813cd45e3756266e2043a3969e0b8590652b8bca08a35b31d8b28
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.s390x.rpm SHA-256: 6b2a6a090e4f7577d9ffeb73fc5ce2dd1705b93b20291d51744231cd52dc4e23

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.4

SRPM
aarch64
xz-debuginfo-5.2.4-4.el8_4.aarch64.rpm SHA-256: b391d963e561af11631451510a28964b178e7809db04279192fb3e81de8ef655
xz-debugsource-5.2.4-4.el8_4.aarch64.rpm SHA-256: 79db34cd21480e45dfb1bb019f57b44dbc2c9b380dec8c8244ae29bbbc4b32eb
xz-libs-debuginfo-5.2.4-4.el8_4.aarch64.rpm SHA-256: 9b9ec211d41abb1995bbbb7dc3abd15c1d71a7676b221d5b091ebbcf9a600d12
xz-lzma-compat-5.2.4-4.el8_4.aarch64.rpm SHA-256: d29f49973bed96dd8c3f8d9d0aa5ae803f6df8f59e4406cb10fa069e9d495724
xz-lzma-compat-debuginfo-5.2.4-4.el8_4.aarch64.rpm SHA-256: 299af64241816265381525b98e90a464e2835a5958ea284be2f8ca8328f0f732

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.