Bug 1663892 (CVE-2018-1000880)

Summary: CVE-2018-1000880 libarchive: Improper input validation in WARC parser resulting in a denial of service
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: databases-maint, pkubat, praiskup
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-27 03:18:57 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1663893, 1663894, 1663895, 1700751    
Bug Blocks: 1663897    

Description Andrej Nemec 2019-01-07 09:38:03 UTC
It was found that WARC parser of libarchive improperly validates input. A crafted archive could cause the application to crash.

Upstream issue:


Upstream patch:


Comment 1 Andrej Nemec 2019-01-07 09:39:11 UTC
Created libarchive tracking bugs for this issue:

Affects: fedora-all [bug 1663893]

Created libarchive3 tracking bugs for this issue:

Affects: epel-6 [bug 1663895]

Created mingw-libarchive tracking bugs for this issue:

Affects: fedora-all [bug 1663894]

Comment 4 Stefan Cornelius 2019-04-17 14:17:18 UTC

This issue did not affect the versions of libarchive as shipped with Red Hat Enterprise Linux 6 and 7.