A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| libarchive | libarchive | — | |
| redhat | enterprise linux | 6.0 | |
| redhat | hardened images | — | |
| redhat | openshift container platform | 4.0 | |
| Red Hat | Red Hat Enterprise Linux 10 | all versions | |
| Red Hat | Red Hat Enterprise Linux 6 | all versions | |
| Red Hat | Red Hat Enterprise Linux 7 | all versions | |
| Red Hat | Red Hat Enterprise Linux 8 | all versions | |
| Red Hat | Red Hat Enterprise Linux 9 | all versions | |
| Red Hat | Red Hat Hardened Images | all versions | |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | |
| Red Hat | Red Hat OpenShift Container Platform 4 | all versions |
cpe:2.3:a:libarchive:libarchive:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.