CVE-2021-31566

HIGH

MEDIUM Priority: 0.03 BB Relevance: 41/100

Published: 2022-08-23 Modified: 2026-11-02 First seen: 2026-11-02 Status: active

Attack Surface

Low Complexity No Auth Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local

AC: Low

PR: None

UI: Required

S: Unchanged

C: High

I: High

A: High

Description

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.

Weakness Classification (1)

CWE-59

Affected Software (16)

Vendor	Product	Version
debian	debian_linux	10.0
fedoraproject	fedora	35
libarchive	libarchive	< 3.5.2
n/a	libarchive	Fixed in libarchive 3.5.2
redhat	codeready_linux_builder	-
redhat	enterprise_linux	8.0
redhat	enterprise_linux_eus	8.6
redhat	enterprise_linux_for_ibm_z_systems	8.0
redhat	enterprise_linux_for_ibm_z_systems_eus	8.6
redhat	enterprise_linux_for_power_little_endian	8.0
redhat	enterprise_linux_for_power_little_endian_eus	8.6
redhat	enterprise_linux_server_aus	8.6
redhat	enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions	8.6
redhat	enterprise_linux_server_tus	8.6
splunk	universal_forwarder	8.2.0 – 8.2.12
splunk	universal_forwarder	9.1.0