Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.6
Red Hat archive utilities can be tricked to stop working
published today
Summary
The Red Hat packages bsdcat, bsdcpio, bsdtar, bsdunzip and libarchive may crash if they process a specially crafted archive file. This could temporarily stop the applications from working, affecting any system that uses them to extract or view archive contents. Install the latest Red Hat update for these packages to resolve the issue.
What to do
- Update redhat bsdcat to version 0:3.8.9-2.1.hum1.
- Update redhat bsdcpio to version 0:3.8.9-2.1.hum1.
- Update redhat bsdtar to version 0:3.8.9-2.1.hum1.
- Update redhat bsdunzip to version 0:3.8.9-2.1.hum1.
- Update redhat libarchive to version 0:3.8.9-2.1.hum1.
- Update redhat libarchive-devel to version 0:3.8.9-2.1.hum1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:hummingbird:1 | redhat | bsdcat |
< 0:3.8.9-2.1.hum1 Fix: upgrade to 0:3.8.9-2.1.hum1
|
| Red Hat:hummingbird:1 | redhat | bsdcpio |
< 0:3.8.9-2.1.hum1 Fix: upgrade to 0:3.8.9-2.1.hum1
|
| Red Hat:hummingbird:1 | redhat | bsdtar |
< 0:3.8.9-2.1.hum1 Fix: upgrade to 0:3.8.9-2.1.hum1
|
| Red Hat:hummingbird:1 | redhat | bsdunzip |
< 0:3.8.9-2.1.hum1 Fix: upgrade to 0:3.8.9-2.1.hum1
|
| Red Hat:hummingbird:1 | redhat | libarchive |
< 0:3.8.9-2.1.hum1 Fix: upgrade to 0:3.8.9-2.1.hum1
|
| Red Hat:hummingbird:1 | redhat | libarchive-devel |
< 0:3.8.9-2.1.hum1 Fix: upgrade to 0:3.8.9-2.1.hum1
|
Original advisory text
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
References
- https://access.redhat.com/errata/RHSA-2026:77775 Vendor Advisory
- https://images.redhat.com/ Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-17591 Third Party Advisory
- https://access.redhat.com/security/updates/classification/ Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77775.... Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2554209 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-17591 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-17591 Vendor Advisory
- https://github.com/libarchive/libarchive/pull/3318 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Sources
RHSA-2026:77775 · OSV
Track software like this
Free during beta