CVE-2023-30571
Reported by mitre · Published May 29, 2023
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| libarchive | conan.io | 3.6.2 |
| libarchive | Chainguard | 3.7.7-r2 |
| libarchive | Wolfi | 3.7.7-r2 |
| libarchive | libarchive | 3.6.2 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| chainguard | libarchive | 0 |
| ConanCenter | libarchive | 0 |
| wolfi | libarchive | 0 |
| n/a | n/a | * |
Timeline
- May 29, 2023 CVE Published
- May 30, 2023 EPSS Score (30 in total, the first dated here)
- Mar 17, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-30571
vulnetix vdb fixes CVE-2023-30571Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-30571/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart