CVE-2021-23177: Debian Linux

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 35 only
• Libarchive Libarchive: before 3.5.2 (fixed in 3.5.2)
• Red Hat Codeready Linux Builder: affected versions not specified
• Red Hat Enterprise Linux: version 8.0 only
• Red Hat Enterprise Linux Eus: version 8.6 only
• Red Hat Enterprise Linux For IBM Z Systems: version 8.0 only
• Red Hat Enterprise Linux For IBM Z Systems Eus: version 8.6 only
• Red Hat Enterprise Linux For Power Little Endian: version 8.0 only
• Red Hat Enterprise Linux For Power Little Endian Eus: version 8.6 only
• Red Hat Enterprise Linux Server Aus: version 8.6 only
• Red Hat Enterprise Linux Server For Power Little Endian Update Services For SAP Solutions: version 8.6 only
• Red Hat Enterprise Linux Server Tus: version 8.6 only

Published 2022-08-23. Last modified 2026-06-17.