CVE-2021-23177

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	libarchive	Fixed in libarchive 3.5.2

References

https://access.redhat.com/security/cve/CVE-2021-23177Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2024245Issue Tracking, Patch, Third Party Advisory
https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336badPatch, Third Party Advisory
https://github.com/libarchive/libarchive/issues/1565Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00030.htmlMailing List, Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-23177Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2024245Issue Tracking, Patch, Third Party Advisory
https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336badPatch, Third Party Advisory
https://github.com/libarchive/libarchive/issues/1565Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00030.htmlMailing List, Third Party Advisory

Timeline

Published: Aug 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-231787.5Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments CVE-2021-231797.1Out of bounds read in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow CVE-2021-23189.1Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The supp CVE-2021-231807.8A flaw was found in htmldoc in v1.9.12 and before. Null pointer dereference in file_extension(),in file.c may lead to execute arbitrary code CVE-2021-231824.4Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be d CVE-2021-231868.7A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and CVE-2021-231883.3Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an authenticated user to potentially e CVE-2021-23199.1Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The supp CVE-2021-231917.8A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function image_load_jpeg() in image.cxx may resu CVE-2021-231927.5A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragmen CVE-2021-231936.5Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators CVE-2021-231955.3Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activ