diff mbox series

[upstream/master] libarchive: set status for CVE-2026-4111

Message ID 20261105205051.61939-1-saisireesha.t@windriver.com
State New
Headers show
Series [upstream/master] libarchive: set status for CVE-2026-4111 | expand

Commit Message

Sai Sireesha T Nov. 5, 2026, 8:50 p.m. UTC 
CVE-2026-4111 describes an infinite loop in the RAR5 decompressor
(archive_read_support_format_rar5.c) caused by missing block_length
validation in parse_filter().

The fix first shipped in libarchive 3.8.6 (PR #2877). NVD has no
CPE/version data for this CVE (Red Hat CNA filed it without version
ranges), so sbom-cve-check reports it as unpatched on 3.8.10. Adding
CVE_STATUS to record the fixed version.

Both the fix and its test are present in the 3.8.10 tarball we build from:
- archive_read_support_format_rar5.c (bounds check in parse_filter)
- test/test_read_format_rar5_loop_bug.c

References:
https://nvd.nist.gov/vuln/detail/CVE-2026-4111
https://github.com/libarchive/libarchive/releases/tag/v3.8.6
https://github.com/libarchive/libarchive/pull/2877
https://github.com/libarchive/libarchive/commit/7273d04803a1e5a482f26d8d0fbaf2b204a72168
https://github.com/libarchive/libarchive/commit/ef53e2023d75a205cf7cbddb5d01c4cc592e9ce4

Signed-off-by: Sai Sireesha T <saisireesha.t@windriver.com>
---
 meta/recipes-extended/libarchive/libarchive_3.8.10.bb | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.10.bb b/meta/recipes-extended/libarchive/libarchive_3.8.10.bb
index 747a6b9969..095dd8ba1c 100644
--- a/meta/recipes-extended/libarchive/libarchive_3.8.10.bb
+++ b/meta/recipes-extended/libarchive/libarchive_3.8.10.bb
@@ -92,6 +92,7 @@  do_install_ptest() {
 
 RDEPENDS:${PN}-ptest += "bsdtar bsdcpio"
 
+CVE_STATUS[CVE-2026-4111] = "fixed-version: fixed since 3.8.6"
 CVE_STATUS[CVE-2026-4424] = "fixed-version: fixed since 3.8.7"
 CVE_STATUS[CVE-2026-4426] = "fixed-version: fixed since 3.8.7"
 CVE_STATUS[CVE-2026-5121] = "fixed-version: fixed since 3.8.7"