Vulnerability CVE-2019-19221

Vulnerability Name:

CVE-2019-19221 (CCN-172119)

Assigned:

2019-11-07

Published:

2019-11-07

Updated:

2022-12-03

Summary:

In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.

CVSS v3 Severity:

5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

3.3 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
2.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

6.5 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
5.7 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

1.7 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-125

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2019-19221

Source: XF
Type: UNKNOWN
libarchive-cve201919221-dos(172119)

Source: cve@mitre.org
Type: Patch, Third Party Advisory
cve@mitre.org

Source: CCN
Type: libarchive GIT Repository
bsdtar: An error in archive_wstring_append_from_mbs() (archive_string.c) allows out-of-bounds read memory access and subsequently cause a crash #1276

Source: cve@mitre.org
Type: Exploit, Issue Tracking, Third Party Advisory
cve@mitre.org

Source: cve@mitre.org
Type: Mailing List, Third Party Advisory
cve@mitre.org

Source: cve@mitre.org
Type: Mailing List, Third Party Advisory
cve@mitre.org

Source: cve@mitre.org
Type: Mailing List, Third Party Advisory
cve@mitre.org

Source: cve@mitre.org
Type: Patch, Third Party Advisory
cve@mitre.org

Source: CCN
Type: IBM Security Bulletin 6520474 (QRadar SIEM)
IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities

Source: CCN
Type: libarchive Web site
libarchive

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2019-19221

Vulnerable Configuration:

Configuration RedHat 1:

cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

Configuration RedHat 3:

cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*

Configuration RedHat 4:

cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

Configuration CCN 1:

cpe:/a:libarchive:libarchive:3.4.0:*:*:*:*:*:*:*

AND

cpe:/a:ibm:qradar_security_information_and_event_manager:7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4:-:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:201919221	V	CVE-2019-19221	2023-06-22
oval:org.opensuse.security:def:7994	P	bsdtar-3.5.1-150400.3.12.1 on GA media (Moderate)	2023-06-20
oval:org.opensuse.security:def:7575	P	libarchive-devel-3.5.1-150400.3.12.1 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:717	P	Security update for zlib (Important)	2022-08-31
oval:org.opensuse.security:def:3369	P	squid-4.8-2.17 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:94624	P	libarchive-devel-3.5.1-150400.1.9 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:94999	P	bsdtar-3.5.1-150400.1.9 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:2994	P	libarchive-devel-3.5.1-150400.1.9 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:121	P	libarchive-devel-3.4.2-2.24 on GA media (Moderate)	2022-06-13
oval:org.opensuse.security:def:1379	P	Security update for the Linux Kernel (Live Patch 9 for SLE 15 SP3) (Important)	2022-06-06
oval:org.opensuse.security:def:112025	P	bsdtar-3.5.1-1.5 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:1050	P	Security update for MozillaFirefox (Important)	2021-12-10
oval:org.opensuse.security:def:93773	P	(Important)	2021-11-22
oval:org.opensuse.security:def:60414	P	Security update for libarchive (Moderate)	2021-11-17
oval:org.opensuse.security:def:26165	P	Security update for libarchive (Moderate)	2021-11-17
oval:org.opensuse.security:def:5152	P	Security update for libarchive (Moderate)	2021-11-17
oval:org.opensuse.security:def:34591	P	Security update for libarchive (Moderate)	2021-11-17
oval:org.opensuse.security:def:105581	P	bsdtar-3.5.1-1.5 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:69704	P	Security update for MozillaFirefox (Important)	2021-08-17
oval:org.opensuse.security:def:101252	P	bsdtar-3.4.2-2.24 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62994	P	bsdtar-3.4.2-2.24 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:71880	P	libarchive-devel-3.4.2-2.24 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:100829	P	expat-2.2.5-3.6.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:100897	P	libarchive-devel-3.4.2-2.24 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62139	P	libarchive-devel-3.4.2-2.24 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1905	P	bsdtar-3.4.2-2.24 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:72713	P	bsdtar-3.4.2-2.24 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:66796	P	Security update for slurm (Important)	2021-05-31
oval:org.opensuse.security:def:69809	P	Security update for ruby2.5 (Important)	2021-03-24
oval:org.opensuse.security:def:66704	P	Security update for slurm_17_11 (Important)	2020-12-18
oval:org.opensuse.security:def:116710	P	libarchive-devel-3.4.2-2.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62937	P	bsdtar-3.4.2-2.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:71547	P	libarchive-devel-3.4.2-2.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:107152	P	libarchive-devel-3.4.2-2.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:100486	P	libarchive-devel-3.4.2-2.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:117053	P	bsdtar-3.4.2-2.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:107495	P	bsdtar-3.4.2-2.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:61806	P	libarchive-devel-3.4.2-2.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:1848	P	bsdtar-3.4.2-2.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72656	P	bsdtar-3.4.2-2.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:94116	P	bsdtar-3.4.2-2.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:70047	P	fwupd on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49820	P	bsdtar on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:66361	P	chrony on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73026	P	Security update for cri-o (Moderate)	2020-12-01
oval:org.opensuse.security:def:70152	P	bsdtar on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73144	P	libarchive-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:66453	P	libarchive-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73369	P	audiofile-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:73487	P	bsdtar on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49104	P	glibc on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49158	P	libarchive-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49766	P	FastCGI on GA media (Moderate)	2020-12-01
oval:com.redhat.rhsa:def:20204443	P	RHSA-2020:4443: libarchive security update (Moderate)	2020-11-04
oval:com.ubuntu.disco:def:2019192210000000	V	CVE-2019-19221 on Ubuntu 19.04 (disco) - low.	2019-11-21
oval:com.ubuntu.bionic:def:2019192210000000	V	CVE-2019-19221 on Ubuntu 18.04 LTS (bionic) - low.	2019-11-21
oval:com.ubuntu.xenial:def:2019192210000000	V	CVE-2019-19221 on Ubuntu 16.04 LTS (xenial) - low.	2019-11-21

BACK