{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos6els/vex/2019/cve-2019-1000020-els_os-centos6els.json" } ], "tracking": { "current_release_date": "2026-10-24T22:04:26Z", "generator": { "date": "2026-10-24T22:04:26Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2019-1000020-ELS_OS-CENTOS6ELS", "initial_release_date": "2019-02-04T21:29:00Z", "revision_history": [ { "date": "2019-02-04T21:29:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-24T22:04:26Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2019-1000020" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 6", "product": { "name": "Community Enterprise Operating System 6", "product_id": "CentOS-6", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" }, { "branches": [ { "category": "product_version", "name": "libarchive-0:2.8.3-7.el6_8.x86_64", "product": { "name": "libarchive-0:2.8.3-7.el6_8.x86_64", "product_id": "libarchive-0:2.8.3-7.el6_8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/libarchive@2.8.3-7.el6_8?arch=x86_64" } } }, { "category": "product_version", "name": "libarchive-devel-0:2.8.3-7.el6_8.x86_64", "product": { "name": "libarchive-devel-0:2.8.3-7.el6_8.x86_64", "product_id": "libarchive-devel-0:2.8.3-7.el6_8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/centos/libarchive-devel@2.8.3-7.el6_8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "libarchive-0:2.8.3-7.el6_8.i686", "product": { "name": "libarchive-0:2.8.3-7.el6_8.i686", "product_id": "libarchive-0:2.8.3-7.el6_8.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/libarchive@2.8.3-7.el6_8?arch=i686" } } }, { "category": "product_version", "name": "libarchive-devel-0:2.8.3-7.el6_8.i686", "product": { "name": "libarchive-devel-0:2.8.3-7.el6_8.i686", "product_id": "libarchive-devel-0:2.8.3-7.el6_8.i686", "product_identification_helper": { "purl": "pkg:rpm/centos/libarchive-devel@2.8.3-7.el6_8?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "product": { "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "product_id": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libarchive@2.8.3-7.el6_8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "product": { "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "product_id": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libarchive-devel@2.8.3-7.el6_8.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "product": { "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "product_id": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libarchive@2.8.3-7.el6_8.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "product": { "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "product_id": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libarchive-devel@2.8.3-7.el6_8.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64" }, "product_reference": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-0:2.8.3-7.el6_8.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:libarchive-0:2.8.3-7.el6_8.x86_64" }, "product_reference": "libarchive-0:2.8.3-7.el6_8.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686" }, "product_reference": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-0:2.8.3-7.el6_8.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:libarchive-0:2.8.3-7.el6_8.i686" }, "product_reference": "libarchive-0:2.8.3-7.el6_8.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64" }, "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-0:2.8.3-7.el6_8.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64" }, "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686" }, "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-0:2.8.3-7.el6_8.i686 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.i686" }, "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.i686", "relates_to_product_reference": "CentOS-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-1000020", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "notes": [ { "category": "description", "text": "libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "CentOS-6:libarchive-0:2.8.3-7.el6_8.i686", "CentOS-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "CentOS-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "CentOS-6:libarchive-0:2.8.3-7.el6_8.x86_64", "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.i686", "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2019-1000020" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2298", "url": "https://access.redhat.com/errata/RHSA-2019:2298" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:3698", "url": "https://access.redhat.com/errata/RHSA-2019:3698" }, { "category": "external", "summary": "https://github.com/libarchive/libarchive/pull/1120", "url": "https://github.com/libarchive/libarchive/pull/1120" }, { "category": "external", "summary": "https://github.com/libarchive/libarchive/pull/1120/commits/8312eaa576014cd9b965012af51bc1f967b12423", "url": "https://github.com/libarchive/libarchive/pull/1120/commits/8312eaa576014cd9b965012af51bc1f967b12423" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2019/02/msg00013.html", "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00013.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/" }, { "category": "external", "summary": "https://usn.ubuntu.com/3884-1/", "url": "https://usn.ubuntu.com/3884-1/" } ], "release_date": "2019-02-04T21:29:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-10-15T08:15:06.218404Z", "details": "This flaw is limited to libarchive’s ISO9660 parsing path and requires a user or task to open a crafted ISO image with a libarchive‑based tool, resulting only in an infinite‑loop denial of service with no confidentiality or integrity impact. ISO9660 parsing is not invoked by default in network‑exposed services and is only executed on demand, so unattended remote exploitation in server/VM deployments is impractical and any impact is confined to the parsing process’s availability. Given the required user interaction and DoS‑only scope, this can be safely deprioritized.", "product_ids": [ "CentOS-6:libarchive-0:2.8.3-7.el6_8.i686", "CentOS-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "CentOS-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "CentOS-6:libarchive-0:2.8.3-7.el6_8.x86_64", "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.i686", "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64" ] } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-6:libarchive-0:2.8.3-7.el6_8.i686", "CentOS-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "CentOS-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "CentOS-6:libarchive-0:2.8.3-7.el6_8.x86_64", "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.i686", "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "CentOS-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }