Bug 1417912 (CVE-2017-5601)

Summary: CVE-2017-5601 libarchive: Out of bounds read in lha_read_file_header_1() function
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: besser82, databases-maint, dhiru, dkholia, gscott, mike, moez.roy, ndevos, praiskup, sardella, trepik
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libarchive 3.3.0 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-02-01 05:37:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1417917, 1417918, 1417919, 1417920, 1417921, 1417922    
Bug Blocks: 1417916    

Description Andrej Nemec 2017-01-31 12:16:36 UTC 
A vulnerability was found in libarchive. There exists an out of bounds read in function lha_read_file_header_1(). A maliciously crafted file could cause the application to crash.

Upstream patch:

https://github.com/libarchive/libarchive/commit/98dcbbf0bf4854bf987557e55e55fff7abbf3ea9

References:

https://secunia.com/secunia_research/2017-3/
Comment 1 Andrej Nemec 2017-01-31 12:23:52 UTC 
Created libarchive tracking bugs for this issue:

Affects: epel-5 [bug 1417919]
Affects: epel-6 [bug 1417917]
Affects: fedora-all [bug 1417920]


Created mingw-libarchive tracking bugs for this issue:

Affects: fedora-all [bug 1417918]


Created python-libarchive tracking bugs for this issue:

Affects: epel-7 [bug 1417922]
Affects: fedora-all [bug 1417921]
Comment 3 Doran Moppert 2017-02-01 05:37:43 UTC 
Statement:

Red Hat Product Security has rated this issue as having Low security
impact. This issue is not currently planned to be addressed in future
updates. For additional information, refer to the Issue Severity
Classification: https://access.redhat.com/security/updates/classification.