代码拉取完成，页面将自动刷新
更新失败，请稍后重试！
/
详情
CVE-2023-30571
评论 (10)
误判申诉
此处可能存在不合适展示的内容，页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容，可点击提交进行申诉，我们将尽快为您处理。
取消
提交
openeuler-ci-bot
添加了
标签
sig/Base-service
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
无
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-29 00:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
无
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-29 00:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
无
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-29 00:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-29 00:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
openeuler-ci-bot
将计划开始日期设置为2023-05-30
openeuler-ci-bot
将计划截止日期设置为2023-06-29
openeuler-ci-bot
将优先级设置为次要
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V2.0分值：
BaseScore：0.0 Low
Vector：CVSS：2.0/
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
5.3
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
openEuler评分：
5.3
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):
2.openEuler-20.03-LTS-SP3(3.4.3):
3.openEuler-22.03-LTS(3.5.2):
4.openEuler-22.03-LTS-SP1(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
openEuler评分：
5.3
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):受影响
2.openEuler-20.03-LTS-SP3(3.4.3):受影响
3.openEuler-22.03-LTS(3.5.2):受影响
4.openEuler-22.03-LTS-SP1(3.5.2):受影响
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):否
2.openEuler-20.03-LTS-SP3(3.4.3):否
3.openEuler-22.03-LTS(3.5.2):否
4.openEuler-22.03-LTS-SP1(3.5.2):否
t.feng
将任务状态从 待办的 修改为已挂起
openeuler-ci-bot
将计划开始日期从 2023-05-30 修改为2023-06-06
openeuler-ci-bot
将计划截止日期从 2023-06-29 修改为2023-07-06
openeuler-ci-bot
将任务状态从 已挂起 修改为待办的
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
openEuler评分：
5.3
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):受影响
2.openEuler-20.03-LTS-SP3(3.4.3):受影响
3.openEuler-22.03-LTS(3.5.2):受影响
4.openEuler-22.03-LTS-SP1(3.5.2):受影响
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):否
2.openEuler-20.03-LTS-SP3(3.4.3):否
3.openEuler-22.03-LTS(3.5.2):否
4.openEuler-22.03-LTS-SP1(3.5.2):否
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1,3.6.2,3.7.1
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:09
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | https://github.com/libarchive/libarchive/issues/1876 | |
| cve.mitre.org | https://groups.google.com/g/libarchive-announce | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| anolis | | https://anas.openanolis.cn/cves/detail/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-30571 | https://explore.alas.aws.amazon.com/CVE-2023-30571.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30571 | https://explore.alas.aws.amazon.com/CVE-2023-30571.html |
| snyk | https://github.com/libarchive/libarchive/issues/1876 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBARCHIVE-5660610 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBARCHIVE-5660610 |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |
| ------- | -------- | ------- | -------- | --------- |
| | | https://github.com/libarchive/libarchive/issues/1876 | | nvd |
| | | https://groups.google.com/g/libarchive-announce | | nvd |
</details>
二、漏洞分析结构反馈
影响性分析说明：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
openEuler评分：
5.3
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):受影响
2.openEuler-20.03-LTS-SP3(3.4.3):受影响
3.openEuler-22.03-LTS(3.5.2):受影响
4.openEuler-22.03-LTS-SP1(3.5.2):受影响
5.openEuler-24.03-LTS-Next(3.7.1):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):否
2.openEuler-20.03-LTS-SP3(3.4.3):否
3.openEuler-22.03-LTS(3.5.2):否
4.openEuler-22.03-LTS-SP1(3.5.2):否
5.openEuler-24.03-LTS-Next(3.7.1):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:00
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
无
</details>
二、漏洞分析结构反馈
影响性分析说明：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
openEuler评分：
5.3
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):受影响
2.openEuler-20.03-LTS-SP3(3.4.3):受影响
3.openEuler-22.03-LTS(3.5.2):受影响
4.openEuler-22.03-LTS-SP1(3.5.2):受影响
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):否
2.openEuler-20.03-LTS-SP3(3.4.3):否
3.openEuler-22.03-LTS(3.5.2):否
4.openEuler-22.03-LTS-SP1(3.5.2):否
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1,3.6.2,3.7.1
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:09
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | https://github.com/libarchive/libarchive/issues/1876 | |
| cve.mitre.org | https://groups.google.com/g/libarchive-announce | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| anolis | | https://anas.openanolis.cn/cves/detail/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-30571 | https://explore.alas.aws.amazon.com/CVE-2023-30571.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30571 | https://explore.alas.aws.amazon.com/CVE-2023-30571.html |
| snyk | https://github.com/libarchive/libarchive/issues/1876 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBARCHIVE-5660610 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBARCHIVE-5660610 |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |
| ------- | -------- | ------- | -------- | --------- |
| | | https://github.com/libarchive/libarchive/issues/1876 | | nvd |
| | | https://groups.google.com/g/libarchive-announce | | nvd |
</details>
二、漏洞分析结构反馈
影响性分析说明：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
openEuler评分：
5.3
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):受影响
2.openEuler-20.03-LTS-SP3(3.4.3):受影响
3.openEuler-22.03-LTS(3.5.2):受影响
4.openEuler-22.03-LTS-SP1(3.5.2):受影响
5.master(3.7.1):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):否
2.openEuler-20.03-LTS-SP3(3.4.3):否
3.openEuler-22.03-LTS(3.5.2):否
4.openEuler-22.03-LTS-SP1(3.5.2):否
5.master(3.7.1):
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1,3.6.2,3.7.1
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:09
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | https://github.com/libarchive/libarchive/issues/1876 | |
| cve.mitre.org | https://groups.google.com/g/libarchive-announce | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| anolis | | https://anas.openanolis.cn/cves/detail/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-30571 | https://explore.alas.aws.amazon.com/CVE-2023-30571.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30571 | https://explore.alas.aws.amazon.com/CVE-2023-30571.html |
| snyk | https://github.com/libarchive/libarchive/issues/1876 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBARCHIVE-5660610 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBARCHIVE-5660610 |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |
| ------- | -------- | ------- | -------- | --------- |
| | | https://github.com/libarchive/libarchive/issues/1876 | | nvd |
| | | https://groups.google.com/g/libarchive-announce | | nvd |
</details>
二、漏洞分析结构反馈
影响性分析说明：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
openEuler评分：
5.3
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):受影响
2.openEuler-20.03-LTS-SP3(3.4.3):受影响
3.openEuler-22.03-LTS(3.5.2):受影响
4.openEuler-22.03-LTS-SP1(3.5.2):受影响
5.master(3.7.1):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):否
2.openEuler-20.03-LTS-SP3(3.4.3):否
3.openEuler-22.03-LTS(3.5.2):否
4.openEuler-22.03-LTS-SP1(3.5.2):否
5.master(3.7.1):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1,3.6.2,3.7.1
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:09
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | https://github.com/libarchive/libarchive/issues/1876 | |
| cve.mitre.org | https://groups.google.com/g/libarchive-announce | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| anolis | | https://anas.openanolis.cn/cves/detail/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-30571 | https://explore.alas.aws.amazon.com/CVE-2023-30571.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30571 | https://explore.alas.aws.amazon.com/CVE-2023-30571.html |
| snyk | https://github.com/libarchive/libarchive/issues/1876 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBARCHIVE-5660610 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBARCHIVE-5660610 |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |
| ------- | -------- | ------- | -------- | --------- |
| | | https://github.com/libarchive/libarchive/issues/1876 | | nvd |
| | | https://groups.google.com/g/libarchive-announce | | nvd |
</details>
二、漏洞分析结构反馈
影响性分析说明：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
openEuler评分：
5.3
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):受影响
2.openEuler-20.03-LTS-SP3(3.4.3):受影响
3.openEuler-22.03-LTS(3.5.2):受影响
4.openEuler-22.03-LTS-SP1(3.5.2):受影响
5.master(3.7.1):
6.openEuler-22.03-LTS-SP4(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):否
2.openEuler-20.03-LTS-SP3(3.4.3):否
3.openEuler-22.03-LTS(3.5.2):否
4.openEuler-22.03-LTS-SP1(3.5.2):否
5.master(3.7.1):
6.openEuler-22.03-LTS-SP4(3.5.2):
openeuler-ci-bot
将负责人从 谢志鹏 修改为sun_hai
原值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1,3.6.2,3.7.1
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:09
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | https://github.com/libarchive/libarchive/issues/1876 | |
| cve.mitre.org | https://groups.google.com/g/libarchive-announce | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| anolis | | https://anas.openanolis.cn/cves/detail/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-30571 | https://explore.alas.aws.amazon.com/CVE-2023-30571.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30571 | https://explore.alas.aws.amazon.com/CVE-2023-30571.html |
| snyk | https://github.com/libarchive/libarchive/issues/1876 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBARCHIVE-5660610 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBARCHIVE-5660610 |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |
| ------- | -------- | ------- | -------- | --------- |
| | | https://github.com/libarchive/libarchive/issues/1876 | | nvd |
| | | https://groups.google.com/g/libarchive-announce | | nvd |
</details>
二、漏洞分析结构反馈
影响性分析说明：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
openEuler评分：
5.3
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(3.4.3):受影响
2.openEuler-20.03-LTS-SP3(3.4.3):受影响
3.openEuler-22.03-LTS(3.5.2):受影响
4.openEuler-22.03-LTS-SP1(3.5.2):受影响
5.master(3.7.1):
6.openEuler-22.03-LTS-SP4(3.5.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(3.4.3):否
2.openEuler-20.03-LTS-SP3(3.4.3):否
3.openEuler-22.03-LTS(3.5.2):否
4.openEuler-22.03-LTS-SP1(3.5.2):否
5.master(3.7.1):
6.openEuler-22.03-LTS-SP4(3.5.2):
新值
一、漏洞信息
漏洞编号：[CVE-2023-30571](https://nvd.nist.gov/vuln/detail/CVE-2023-30571)
漏洞归属组件：[libarchive](https://gitee.com/src-openeuler/libarchive)
漏洞归属的版本：3.4.3,3.5.1,3.5.2,3.6.1,3.6.2,3.7.1
CVSS V3.0分值：
BaseScore：5.3 Medium
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
漏洞简述：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
漏洞公开时间：2023-05-30 04:15:09
漏洞创建时间：2023-05-30 04:34:46
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-30571
<details>
<summary>更多参考(点击展开)</summary>
| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | https://github.com/libarchive/libarchive/issues/1876 | |
| cve.mitre.org | https://groups.google.com/g/libarchive-announce | |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-30571 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| suse_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.suse.com/show_bug.cgi?id=1211842 |
| redhat_bugzilla | https://groups.google.com/g/libarchive-announce | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| redhat_bugzilla | https://github.com/libarchive/libarchive/issues/1876 | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 |
| debian | | https://security-tracker.debian.org/tracker/CVE-2023-30571 |
| anolis | | https://anas.openanolis.cn/cves/detail/CVE-2023-30571 |
| cve_search | | https://groups.google.com/g/libarchive-announce |
| cve_search | | https://github.com/libarchive/libarchive/issues/1876 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-30571 | https://explore.alas.aws.amazon.com/CVE-2023-30571.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30571 | https://explore.alas.aws.amazon.com/CVE-2023-30571.html |
| snyk | https://github.com/libarchive/libarchive/issues/1876 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBARCHIVE-5660610 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2210921 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBARCHIVE-5660610 |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
| redhat | https://access.redhat.com/security/cve/CVE-2023-30571 | |
| nvd | https://groups.google.com/g/libarchive-announce | |
| nvd | https://github.com/libarchive/libarchive/issues/1876 | |
</details>
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
<details>
<summary>详情(点击展开)</summary>
| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |
| ------- | -------- | ------- | -------- | --------- |
| | | https://github.com/libarchive/libarchive/issues/1876 | | nvd |
| | | https://groups.google.com/g/libarchive-announce | | nvd |
</details>
二、漏洞分析结构反馈
影响性分析说明：
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
openEuler评分：
5.3
Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
受影响版本排查(受影响/不受影响)：
1.master(3.7.1):受影响
2.openEuler-20.03-LTS-SP4(3.4.3):受影响
3.openEuler-22.03-LTS-SP1(3.5.2):受影响
4.openEuler-22.03-LTS-SP3(3.5.2):受影响
5.openEuler-22.03-LTS-SP4(3.5.2):受影响
6.openEuler-24.03-LTS(3.7.1):受影响
7.openEuler-24.03-LTS-Next(3.7.1):受影响
修复是否涉及abi变化(是/否)：
1.master(3.7.1):否
2.openEuler-20.03-LTS-SP4(3.4.3):否
3.openEuler-22.03-LTS-SP1(3.5.2):否
4.openEuler-22.03-LTS-SP3(3.5.2):否
5.openEuler-22.03-LTS-SP4(3.5.2):否
6.openEuler-24.03-LTS(3.7.1):否
7.openEuler-24.03-LTS-Next(3.7.1):否
sun_hai
将任务状态从 待办的 修改为已挂起
登录 后才可以发表评论