{"id":"CVE-2021-23177","details":"An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.","modified":"2026-04-12T00:08:10.204136Z","published":"2022-08-23T16:15:09.280Z","related":["ALSA-2022:0892","SUSE-SU-2022:3306-1","SUSE-SU-2022:3393-1","openSUSE-SU-2024:13549-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_FIELD","extracted_events":[{"last_affected":"10.0"}],"cpe":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"},{"source":"CPE_FIELD","extracted_events":[{"last_affected":"35"}],"cpe":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"},{"source":"CPE_FIELD","extracted_events":[{"last_affected":"8.0"}],"cpe":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"},{"source":"CPE_FIELD","extracted_events":[{"last_affected":"8.6"}],"cpe":"cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*"},{"source":"CPE_FIELD","extracted_events":[{"last_affected":"8.0"}],"cpe":"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*"},{"source":"CPE_FIELD","extracted_events":[{"last_affected":"8.6"}],"cpe":"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*"},{"source":"CPE_FIELD","extracted_events":[{"last_affected":"8.0"}],"cpe":"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*"},{"source":"CPE_FIELD","extracted_events":[{"last_affected":"8.6"}],"cpe":"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*"},{"source":"CPE_FIELD","extracted_events":[{"last_affected":"8.6"}],"cpe":"cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*"},{"source":"CPE_FIELD","extracted_events":[{"last_affected":"8.6"}],"cpe":"cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*"},{"source":"CPE_FIELD","extracted_events":[{"last_affected":"8.6"}],"cpe":"cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*"}]},"references":[{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2021-23177"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00030.html"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024245"},{"type":"FIX","url":"https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad"},{"type":"FIX","url":"https://github.com/libarchive/libarchive/issues/1565"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libarchive/libarchive","events":[{"introduced":"0"},{"fixed":"1b2c437b99b361c7692538fa373e99955e9b93ae"},{"fixed":"fba4f123cc456d2b2538f811bb831483bf336bad"}],"database_specific":{"source":["CPE_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"3.5.2"}],"cpe":"cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*"}}],"versions":["v3.0.0a","v3.0.1b","v3.1.900a","v3.2.0","v3.2.1","v3.2.2","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.4.0","v3.4.1","v3.4.2","v3.4.3","v3.5.0","v3.5.1"],"database_specific":{"vanir_signatures_modified":"2026-04-12T00:08:10Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-23177.json","vanir_signatures":[{"id":"CVE-2021-23177-0c1bd6e2","signature_type":"Function","deprecated":false,"signature_version":"v1","target":{"function":"set_acl","file":"libarchive/archive_disk_acl_freebsd.c"},"source":"https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad","digest":{"length":4917,"function_hash":"119863235124518575270985428048575660452"}},{"id":"CVE-2021-23177-5d16566d","signature_type":"Function","deprecated":false,"signature_version":"v1","target":{"function":"set_richacl","file":"libarchive/archive_disk_acl_linux.c"},"source":"https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad","digest":{"length":2892,"function_hash":"247656066004948287138564276136791744976"}},{"id":"CVE-2021-23177-7a77de8b","signature_type":"Function","deprecated":false,"signature_version":"v1","target":{"function":"set_acl","file":"libarchive/archive_disk_acl_linux.c"},"source":"https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad","digest":{"length":2866,"function_hash":"302990961322684235683817322928752066115"}},{"id":"CVE-2021-23177-8d82bea3","signature_type":"Function","deprecated":false,"signature_version":"v1","target":{"function":"archive_write_disk_set_acls","file":"libarchive/archive_disk_acl_sunos.c"},"source":"https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad","digest":{"length":547,"function_hash":"52790904636013997542601074658456549946"}},{"id":"CVE-2021-23177-b0e73bb0","signature_type":"Function","deprecated":false,"signature_version":"v1","target":{"function":"archive_write_disk_set_acls","file":"libarchive/archive_disk_acl_freebsd.c"},"source":"https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad","digest":{"length":824,"function_hash":"35384814950336608914965040955053504744"}},{"id":"CVE-2021-23177-c08cc697","signature_type":"Function","deprecated":false,"signature_version":"v1","target":{"function":"archive_write_disk_set_acls","file":"libarchive/archive_disk_acl_linux.c"},"source":"https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad","digest":{"length":968,"function_hash":"263031339257398541578009937029100212642"}},{"id":"CVE-2021-23177-d819f446","signature_type":"Line","deprecated":false,"signature_version":"v1","target":{"file":"libarchive/archive_disk_acl_sunos.c"},"source":"https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad","digest":{"line_hashes":["84990743136418828527462510462062511907","22859693072452959139744747115909369270","115334538010198384267700553576031112416","3042903274904374635866907155597520168","304812151970705618377174090172717593445","242873013570215163891779995925904880076","39536394315240468706685208083702613514","124078169523069087491718815388305370911","242966959617250580974428329096942640228","187829038392698695668984727268345940729","22340609179081170511628492016248220360","118760957168650623631216286302237692362","57476135617708118244780041361405711318","189512589557562900187888762189196606482","36395643105050333748370086763360079794","253824529166211766929494839252701928624","234694127356842474677596494888878718103","147875983475137501416103664521612499462"],"threshold":0.9}},{"id":"CVE-2021-23177-eccefea9","signature_type":"Function","deprecated":false,"signature_version":"v1","target":{"function":"set_acl","file":"libarchive/archive_disk_acl_sunos.c"},"source":"https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad","digest":{"length":4985,"function_hash":"265072810972092415907080833734331220404"}},{"id":"CVE-2021-23177-fac0efc9","signature_type":"Line","deprecated":false,"signature_version":"v1","target":{"file":"libarchive/archive_disk_acl_freebsd.c"},"source":"https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad","digest":{"line_hashes":["84990743136418828527462510462062511907","22859693072452959139744747115909369270","115334538010198384267700553576031112416","311104811035708422485853231085491373802","151354966052041538065268232937089411238","62882597281865252390221075842624393894","171612392568340577838467011432770583982","268249881924715148944500090443294538496","2513709530809017008507271607761769280","287928638959750005586135720710442108686","85851401220750850729048418580891421732","29367563557898392387666504434358689585","204446129635919608441645671690260388399","225405089247558615039648400756762992418","3647264055995467654692287383784194006","24373819093303007605257797844198040002","290542635402142824665876110217430807871","243581702265247626786650259006847014683","231458421834209525064285454195791704750","238255219782604529165226811497664971449","308329974374425027968506096878110307634","262023106250228515035554986922517675958","33689233651467368050934500628079971602","253824529166211766929494839252701928624","234694127356842474677596494888878718103","147875983475137501416103664521612499462"],"threshold":0.9}},{"id":"CVE-2021-23177-fc0fa152","signature_type":"Line","deprecated":false,"signature_version":"v1","target":{"file":"libarchive/archive_disk_acl_linux.c"},"source":"https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad","digest":{"line_hashes":["304008535235936808083386740926997442912","176430584519154342942889019626544819025","24228361494896306296459761476420579033","287850838011923136632083156206571583409","22859693072452959139744747115909369270","115334538010198384267700553576031112416","311104811035708422485853231085491373802","151354966052041538065268232937089411238","62882597281865252390221075842624393894","171612392568340577838467011432770583982","29367563557898392387666504434358689585","204446129635919608441645671690260388399","225405089247558615039648400756762992418","3647264055995467654692287383784194006","24373819093303007605257797844198040002","290542635402142824665876110217430807871","243581702265247626786650259006847014683","231458421834209525064285454195791704750","238255219782604529165226811497664971449","64455699296391837276626849341514225792","186238808539091791794299157509030806750"],"threshold":0.9}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}