Bug 2024242

Summary:	libarchive: modifies file flags of symlink target
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abuckta, aprice, bdettelb, caswilli, cmyers, crizzo, databases-maint, dfreiber, dkuc, dnakabaa, doconnor, drow, eshamard, fjansen, ggastald, jburrell, jdobes, jkoehler, jmartisk, jmitchel, jnakfour, jsamir, jvasik, jwong, kaycoth, kshier, lcouzens, lphiri, mike, mulliken, ndevos, odubaj, oezr, orabin, panovotn, pbohmill, pkubat, praiskup, psegedy, rblanco, rhel-process-autobot, sbiarozk, teagle, vkumar, vmugicag, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-26 04:30:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2024238, 2024243, 2024244
Bug Blocks:	2024258

Description Guilherme de Almeida Suckevicz 2021-11-17 16:50:37 UTC

libarchive before 3.5.2, when opening a file descriptor to set file flags on Linux, would follow symbolic links. In case an archive contains a directory entry followed by a symlink entry with the same path, libarchive would modify file flags of the symlink target.

Reference and upstream patch:
https://github.com/libarchive/libarchive/commit/e2ad1a2c3064fa9eba6274b3641c4c1beed25c0b

Comment 1 Guilherme de Almeida Suckevicz 2021-11-17 16:50:58 UTC

Created libarchive tracking bugs for this issue:

Affects: fedora-all [bug 2024244]


Created mingw-libarchive tracking bugs for this issue:

Affects: fedora-all [bug 2024243]

Comment 5 Doran Moppert 2021-11-26 04:30:37 UTC

This is a continuation of bug 2024237, completing the fix begun there.

*** This bug has been marked as a duplicate of bug 2024237 ***