Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.0308.2
libarchive security update
30 January 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libarchive
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 8
Red Hat Enterprise Linux WS/Desktop 8
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2019-18408
Reference: ESB-2020.0234
ESB-2019.4511
ESB-2019.4055
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:0246
https://access.redhat.com/errata/RHSA-2020:0271
Comment: This bulletin contains two (2) Red Hat security advisories.
Revision History: January 30 2020: Vendor released additional associated advisory RHSA-2020:0271-0
January 29 2020: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: libarchive security update
Advisory ID: RHSA-2020:0246-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:0246
Issue date: 2020-01-27
CVE Names: CVE-2019-18408
=====================================================================
1. Summary:
An update for libarchive is now available for Red Hat Enterprise Linux 8.0
Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux BaseOS E4S (v. 8.0) - ppc64le, x86_64
3. Description:
The libarchive programming library can create and read several different
streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM
images. Libarchive is used notably in the bsdtar utility, scripting
language bindings such as python-libarchive, and several popular desktop
file managers.
Security Fix(es):
* libarchive: use-after-free in archive_read_format_rar_read_data when
there is an error in the decompression of an archive entry (CVE-2019-18408)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1769979 - CVE-2019-18408 libarchive: use-after-free in archive_read_format_rar_read_data when there is an error in the decompression of an archive entry
6. Package List:
Red Hat Enterprise Linux BaseOS E4S (v. 8.0):
Source:
libarchive-3.3.2-4.el8_0.src.rpm
ppc64le:
bsdcat-debuginfo-3.3.2-4.el8_0.ppc64le.rpm
bsdcpio-debuginfo-3.3.2-4.el8_0.ppc64le.rpm
bsdtar-3.3.2-4.el8_0.ppc64le.rpm
bsdtar-debuginfo-3.3.2-4.el8_0.ppc64le.rpm
libarchive-3.3.2-4.el8_0.ppc64le.rpm
libarchive-debuginfo-3.3.2-4.el8_0.ppc64le.rpm
libarchive-debugsource-3.3.2-4.el8_0.ppc64le.rpm
x86_64:
bsdcat-debuginfo-3.3.2-4.el8_0.i686.rpm
bsdcat-debuginfo-3.3.2-4.el8_0.x86_64.rpm
bsdcpio-debuginfo-3.3.2-4.el8_0.i686.rpm
bsdcpio-debuginfo-3.3.2-4.el8_0.x86_64.rpm
bsdtar-3.3.2-4.el8_0.x86_64.rpm
bsdtar-debuginfo-3.3.2-4.el8_0.i686.rpm
bsdtar-debuginfo-3.3.2-4.el8_0.x86_64.rpm
libarchive-3.3.2-4.el8_0.i686.rpm
libarchive-3.3.2-4.el8_0.x86_64.rpm
libarchive-debuginfo-3.3.2-4.el8_0.i686.rpm
libarchive-debuginfo-3.3.2-4.el8_0.x86_64.rpm
libarchive-debugsource-3.3.2-4.el8_0.i686.rpm
libarchive-debugsource-3.3.2-4.el8_0.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-18408
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXi9HmtzjgjWX9erEAQis5g//QpYvhLVeQx/cmT1t24GDfpI2QK9TdSI3
zxHdYf21itlpBcePWKGXT/VtxJ5eBSfE141NgTdFBqRU8EMvrIzRUPjlZoZF4jkt
MwgVcSZY5imnVOA78c3Nq2h0iW1j8NGJIE2vF/tco8n2rhTIOR1l0YbEJqXPDgAF
GyZw9GCRHO3JuPHtEcC6F2WK/4J5gQBdoUFtPZx+APwDxQhXIMWRtveXAGUzcbGs
jqhVgNr4LJEz5UUsmGRupktscAmbT7rXOaqLKK65KjgnlwMAZmZeppVWw/GeMezm
4QI2Ab77Cop4gPPONnL8UnrXIq69O/EEh7bCaDBdrOM9nty5DYi9bbwhBymFapn0
U+wkNaa3HLYmnfl4xz+7ejSXZGqjfOSwOLnjQJ+DOooTcqYTlihurfAcAnESvTHl
WjJnBQlqZhIXevMm6pLOdiHrO9ZyaDOsRQVuxlxHljdJSqL3NkCCgr/AGsmADZRY
aoxApMWyh+lqizPR271g+8pqXQlMOK04lOJILYLlGRF6flfjN5RR9aFdjimtzKJV
t9hm0E0Gew0dt0H6IMwUOkKGA8csDplODSZ+D5gSvLm4G3VMgiWOeRBTL3CWtw8S
gW8IzgTHq6YjPIEAyPr0EFVsT5U3wa6FH9PDdXihhU5+vSNVfVhuVKMcwu2/949Q
vsf8xmZEmNM=
=gYu9
- -----END PGP SIGNATURE-----
- ------------------------------------------------------------------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: libarchive security update
Advisory ID: RHSA-2020:0271-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:0271
Issue date: 2020-01-29
CVE Names: CVE-2019-18408
=====================================================================
1. Summary:
An update for libarchive is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64
3. Description:
The libarchive programming library can create and read several different
streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM
images. Libarchive is used notably in the bsdtar utility, scripting
language bindings such as python-libarchive, and several popular desktop
file managers.
Security Fix(es):
* libarchive: use-after-free in archive_read_format_rar_read_data when
there is an error in the decompression of an archive entry (CVE-2019-18408)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1769979 - CVE-2019-18408 libarchive: use-after-free in archive_read_format_rar_read_data when there is an error in the decompression of an archive entry
6. Package List:
Red Hat Enterprise Linux BaseOS (v. 8):
Source:
libarchive-3.3.2-8.el8_1.src.rpm
aarch64:
bsdcat-debuginfo-3.3.2-8.el8_1.aarch64.rpm
bsdcpio-debuginfo-3.3.2-8.el8_1.aarch64.rpm
bsdtar-3.3.2-8.el8_1.aarch64.rpm
bsdtar-debuginfo-3.3.2-8.el8_1.aarch64.rpm
libarchive-3.3.2-8.el8_1.aarch64.rpm
libarchive-debuginfo-3.3.2-8.el8_1.aarch64.rpm
libarchive-debugsource-3.3.2-8.el8_1.aarch64.rpm
ppc64le:
bsdcat-debuginfo-3.3.2-8.el8_1.ppc64le.rpm
bsdcpio-debuginfo-3.3.2-8.el8_1.ppc64le.rpm
bsdtar-3.3.2-8.el8_1.ppc64le.rpm
bsdtar-debuginfo-3.3.2-8.el8_1.ppc64le.rpm
libarchive-3.3.2-8.el8_1.ppc64le.rpm
libarchive-debuginfo-3.3.2-8.el8_1.ppc64le.rpm
libarchive-debugsource-3.3.2-8.el8_1.ppc64le.rpm
s390x:
bsdcat-debuginfo-3.3.2-8.el8_1.s390x.rpm
bsdcpio-debuginfo-3.3.2-8.el8_1.s390x.rpm
bsdtar-3.3.2-8.el8_1.s390x.rpm
bsdtar-debuginfo-3.3.2-8.el8_1.s390x.rpm
libarchive-3.3.2-8.el8_1.s390x.rpm
libarchive-debuginfo-3.3.2-8.el8_1.s390x.rpm
libarchive-debugsource-3.3.2-8.el8_1.s390x.rpm
x86_64:
bsdcat-debuginfo-3.3.2-8.el8_1.i686.rpm
bsdcat-debuginfo-3.3.2-8.el8_1.x86_64.rpm
bsdcpio-debuginfo-3.3.2-8.el8_1.i686.rpm
bsdcpio-debuginfo-3.3.2-8.el8_1.x86_64.rpm
bsdtar-3.3.2-8.el8_1.x86_64.rpm
bsdtar-debuginfo-3.3.2-8.el8_1.i686.rpm
bsdtar-debuginfo-3.3.2-8.el8_1.x86_64.rpm
libarchive-3.3.2-8.el8_1.i686.rpm
libarchive-3.3.2-8.el8_1.x86_64.rpm
libarchive-debuginfo-3.3.2-8.el8_1.i686.rpm
libarchive-debuginfo-3.3.2-8.el8_1.x86_64.rpm
libarchive-debugsource-3.3.2-8.el8_1.i686.rpm
libarchive-debugsource-3.3.2-8.el8_1.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 8):
aarch64:
bsdcat-debuginfo-3.3.2-8.el8_1.aarch64.rpm
bsdcpio-debuginfo-3.3.2-8.el8_1.aarch64.rpm
bsdtar-debuginfo-3.3.2-8.el8_1.aarch64.rpm
libarchive-debuginfo-3.3.2-8.el8_1.aarch64.rpm
libarchive-debugsource-3.3.2-8.el8_1.aarch64.rpm
libarchive-devel-3.3.2-8.el8_1.aarch64.rpm
ppc64le:
bsdcat-debuginfo-3.3.2-8.el8_1.ppc64le.rpm
bsdcpio-debuginfo-3.3.2-8.el8_1.ppc64le.rpm
bsdtar-debuginfo-3.3.2-8.el8_1.ppc64le.rpm
libarchive-debuginfo-3.3.2-8.el8_1.ppc64le.rpm
libarchive-debugsource-3.3.2-8.el8_1.ppc64le.rpm
libarchive-devel-3.3.2-8.el8_1.ppc64le.rpm
s390x:
bsdcat-debuginfo-3.3.2-8.el8_1.s390x.rpm
bsdcpio-debuginfo-3.3.2-8.el8_1.s390x.rpm
bsdtar-debuginfo-3.3.2-8.el8_1.s390x.rpm
libarchive-debuginfo-3.3.2-8.el8_1.s390x.rpm
libarchive-debugsource-3.3.2-8.el8_1.s390x.rpm
libarchive-devel-3.3.2-8.el8_1.s390x.rpm
x86_64:
bsdcat-debuginfo-3.3.2-8.el8_1.i686.rpm
bsdcat-debuginfo-3.3.2-8.el8_1.x86_64.rpm
bsdcpio-debuginfo-3.3.2-8.el8_1.i686.rpm
bsdcpio-debuginfo-3.3.2-8.el8_1.x86_64.rpm
bsdtar-debuginfo-3.3.2-8.el8_1.i686.rpm
bsdtar-debuginfo-3.3.2-8.el8_1.x86_64.rpm
libarchive-debuginfo-3.3.2-8.el8_1.i686.rpm
libarchive-debuginfo-3.3.2-8.el8_1.x86_64.rpm
libarchive-debugsource-3.3.2-8.el8_1.i686.rpm
libarchive-debugsource-3.3.2-8.el8_1.x86_64.rpm
libarchive-devel-3.3.2-8.el8_1.i686.rpm
libarchive-devel-3.3.2-8.el8_1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-18408
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXjE7h9zjgjWX9erEAQggvw/7B3OdQrrc2z3F4ii7x5youKb7GrGHFtS9
2vroReXVmv4GZjVgCA8fUH/YTVIcHKjAD2wv63uU+VIoaCRK8BNtg60NEsZD4hhR
raYvtHJHha+vNEICuEI8TMwlQVpbq2NENhB6i7VtOOxPo1naRG9ppDEGrvPrQvq8
G5OnP/tXf0BEK1uFtjKC3sPqsdDhqjs1XfzE6Omx2byaLcw3T3kY6zRhKWNnMXQ/
fBVu1OJqT5IK9RClOSgrKv/u2b5d1N0c+IGOu03ILhyUkqNgBkNVW1dhvPGCjnyV
1IqbmRhjwBwh24ao4O5yAHNUiICkvO5xT7PCgCjuQsEud0RKxSMHNk3dB1csszR2
iYUGggmbegogqtDw42C+MySPwb/hH/iE4loujp/H/KZO5B2Au2EEx5Uw2Os3lL2p
FFBUD2V99Y3ioeCJMu/xs1sTxwXve0GMQ4frK1TwRS4GUYRR6lqmxMPuriDFawbF
tiZrx+l8iwfGebTuJTR/VDxZXXR13yE6A98VEQAOdDxUVQ/p+G/+dflobRft6bRv
RYyYNkxRYWUa6hyTg2XPSCejMZ+jFO70NN6vPnd7RrnMSogbF/SwjJRodrYtz7S8
f/83eL8JVhJFwj9WIL0yDsDi7TNCG1wil5GS49aa5f57Q6/4qzBDdTqKZ2SM9Pf4
3mgEGIr2hLo=
=5/3w
- -----END PGP SIGNATURE-----
- --
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXjILq2aOgq3Tt24GAQjkvxAAwnfwPRxUS7dKKdEicuB7sDnHsvd5j5cI
DOBFqYpjBSS6arTtniR78bQH3Wt5s9qIhSIxLDnuy8dv/prmXY7yeGjtJTrApe1v
6kw9Fc0nbcp4NngUHFx2fLHj7/hwZ6lwcUDOwMHLbdfNJZ9y+f2ZUoAZ3ft79rNF
caYPAmjLuTC0LwTMRaYBfTO/yYlpLVNFjeU7wXJR6J2vPUcei/1i12wb/IyeUNf3
tUh6x8475KSw+1q6TN4CS8ROpNZ9rZ7MZ8GDe5dOLMRa/yM0pcMjBiNm5pLPkqXj
hL1YVZqKF8R6ZFCtmCXYhslUSIAHy3ExO4Dfwpk/v0U+BAvXLPIf9btvKG6jslVE
3KXTm4smwYAe2U/QrIYR4BwOMZEvqb9m1cNpa/c0PTE8b9x4s7YSthNmuIJo7D2e
j/8CIIJeR6Yx+RBk2rTCMEnBIlwXHy+7PcaCSJlBT521b16ojKJCB1ymi/BAugBr
xdSdMHbIhkfLiD4R3YtpLEqYnBlJwsbvBSog/QEzRdWkhy0tu1SVPyNiPrUiIAWk
1xW+rAVK9BCqjZNzl2rS2Kf5KnYnriuCNC+5nIpaz3N5+Im5YY/CRz8HawNzjhR5
3CCCNIi6sejZX1ycfVlWoqIZ/D06p/YR1wWQG8pl6oIzqE43xID76yfZBWEfT+sB
9M79cHK3Gmc=
=rtSA
-----END PGP SIGNATURE-----