libarchive 3.5.2 has been released on August 22: https://github.com/libarchive/libarchive/releases/tag/v3.5.2 It lists a few security fixes in the release announcement.
Suggested advisory: ======================== The updated packages fix several bugs including security vulnerabilities: Fix handling of symbolic link ACLs on Linux. Never follow symlinks when setting file flags on Linux. Do not follow symlinks when processing the fixup list. References: https://github.com/libarchive/libarchive/releases/tag/v3.5.2 ======================== Updated packages in core/updates_testing: ======================== bsdcat-3.5.2-1.mga8 bsdtar-3.5.2-1.mga8 bsdcpio-3.5.2-1.mga8 lib(64)archive-devel-3.5.2-1.mga8 lib(64)archive13-3.5.2-1.mga8 from SRPM: libarchive-3.5.2-1.mga8.src.rpm
Assignee: nicolas.salguero => qa-bugsStatus: NEW => ASSIGNED
MGA8 - 64bit okay I installed installed bsdcat bsdtar lib64archive13-3.5.2-1 I created a link using (ln -s) command The used bsdtar to archive the folder with the link The resulting tar file did have the link in it, but did not download the contents of the link into the tar. I was able to extract using archiver in gnome, it contained the link which still attempted to point to the folder (on another machine. The tools seems to work, but I'm not sure I comprehend what this fixed.
CC: (none) => brtians1
MGA8-64 Plasma on Lenovo B50 No installation issues. Ref bug 2337 for testing. $ cd Documenten $ ls Charts/ jetty/ main.js qtwebengin.txt thumbnail.py tutorialredis.txt win10reg/ wiresh/ ziekenhuis/ $ bsdtar -c -f ~/archtar * Opened archtar with ark, all looks OK $ cd ~/tmp/ [tester8@mach5 tmp]$ bsdtar -x -f /home/tester8/archtar Checked contents of tmp: all files and folders are there OK.
CC: (none) => herman.viaeneWhiteboard: (none) => MGA8-64-OK
Validating. Advisory in Comment 1.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => advisoryCC: (none) => davidwhodgins
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0430.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED
One of the security issues fixed in this update is CVE-2021-23177: https://ubuntu.com/security/notices/USN-5291-1
Summary: libarchive new security issues fixed upstream in 3.5.2 => libarchive new security issues fixed upstream in 3.5.2 (including CVE-2021-23177)