{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2023/cve-2023-30571-els_os-oraclelinux6els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-25T05:00:28Z",
      "generator": {
        "date": "2026-10-25T05:00:28Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2023-30571-ELS_OS-ORACLELINUX6ELS",
      "initial_release_date": "2023-05-29T20:15:00Z",
      "revision_history": [
        {
          "date": "2023-05-29T20:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-25T05:00:28Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2023-30571"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Oracle Linux 6",
                "product": {
                  "name": "Oracle Linux 6",
                  "product_id": "Oracle-Linux-6",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Oracle Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-0:2.8.3-7.el6_8.i686",
                "product": {
                  "name": "libarchive-0:2.8.3-7.el6_8.i686",
                  "product_id": "libarchive-0:2.8.3-7.el6_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libarchive@2.8.3-7.el6_8?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-devel-0:2.8.3-7.el6_8.i686",
                "product": {
                  "name": "libarchive-devel-0:2.8.3-7.el6_8.i686",
                  "product_id": "libarchive-devel-0:2.8.3-7.el6_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libarchive-devel@2.8.3-7.el6_8?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-0:2.8.3-7.el6_8.x86_64",
                "product": {
                  "name": "libarchive-0:2.8.3-7.el6_8.x86_64",
                  "product_id": "libarchive-0:2.8.3-7.el6_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libarchive@2.8.3-7.el6_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-devel-0:2.8.3-7.el6_8.x86_64",
                "product": {
                  "name": "libarchive-devel-0:2.8.3-7.el6_8.x86_64",
                  "product_id": "libarchive-devel-0:2.8.3-7.el6_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libarchive-devel@2.8.3-7.el6_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                "product": {
                  "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                  "product_id": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libarchive@2.8.3-7.el6_8.tuxcare.els1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                "product": {
                  "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                  "product_id": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libarchive-devel@2.8.3-7.el6_8.tuxcare.els1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                  "product_id": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libarchive@2.8.3-7.el6_8.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                  "product_id": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libarchive-devel@2.8.3-7.el6_8.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686"
        },
        "product_reference": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-0:2.8.3-7.el6_8.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.i686"
        },
        "product_reference": "libarchive-0:2.8.3-7.el6_8.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64"
        },
        "product_reference": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-0:2.8.3-7.el6_8.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.x86_64"
        },
        "product_reference": "libarchive-0:2.8.3-7.el6_8.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686"
        },
        "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-devel-0:2.8.3-7.el6_8.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.i686"
        },
        "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64"
        },
        "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-devel-0:2.8.3-7.el6_8.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64"
        },
        "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-30571",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
      },
      "notes": [
        {
          "category": "description",
          "text": "Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.i686",
          "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
          "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
          "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.x86_64",
          "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.i686",
          "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
          "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
          "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2023-30571"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/issues/1876",
          "url": "https://github.com/libarchive/libarchive/issues/1876"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/libarchive-announce",
          "url": "https://groups.google.com/g/libarchive-announce"
        }
      ],
      "release_date": "2023-05-29T20:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T10:08:46.994052Z",
          "details": "This is a local-only race condition that requires a multi‑threaded process using libarchive’s archive_write_disk path and a precisely timed interleaving that momentarily sets the process umask to 0; single‑threaded or read‑only uses are not impacted. Even if hit, it only affects implicitly created directories during that window (0777 without the sticky bit) and is exploitable only if those directories are created in locations other local users can traverse; there is no confidentiality impact or privilege escalation. Given the high attack complexity, requirement for local co-residency, and primarily availability/limited‑integrity impact, this can be safely deprioritized in enterprise VM/server deployments.",
          "product_ids": [
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.i686",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.x86_64",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.i686",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.i686",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.x86_64",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.i686",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}