{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/ubuntu18.04els/vex/2023/cve-2023-30571-els_os-ubuntu18_04els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-08-28T12:56:24Z",
      "generator": {
        "date": "2026-08-28T12:56:24Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2023-30571-ELS_OS-UBUNTU18.04ELS",
      "initial_release_date": "2023-05-29T20:15:00Z",
      "revision_history": [
        {
          "date": "2023-05-29T20:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-28T12:56:24Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2023-30571"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Ubuntu 18.04",
                "product": {
                  "name": "Ubuntu 18.04",
                  "product_id": "Ubuntu-18",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Ubuntu"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
                "product": {
                  "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
                  "product_id": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/ubuntu/libarchive-tools@3.2.2-3.1ubuntu0.7?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64",
                "product": {
                  "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64",
                  "product_id": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/ubuntu/libarchive13@3.2.2-3.1ubuntu0.7?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
                "product": {
                  "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
                  "product_id": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/ubuntu/libarchive-dev@3.2.2-3.1ubuntu0.7?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
                "product": {
                  "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
                  "product_id": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/ubuntu/bsdcpio@3.2.2-3.1ubuntu0.7?arch=all"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all",
                "product": {
                  "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all",
                  "product_id": "bsdtar-0:3.2.2-3.1ubuntu0.7.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/ubuntu/bsdtar@3.2.2-3.1ubuntu0.7?arch=all"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "all"
          }
        ],
        "category": "vendor",
        "name": "Canonical Ltd."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                "product": {
                  "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                  "product_id": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/libarchive-tools@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                "product": {
                  "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                  "product_id": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/libarchive13@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                "product": {
                  "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                  "product_id": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/libarchive-dev@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
                "product": {
                  "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
                  "product_id": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/bsdcpio@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=all"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
                "product": {
                  "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
                  "product_id": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/bsdtar@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=all"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "all"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64"
        },
        "product_reference": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64"
        },
        "product_reference": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64"
        },
        "product_reference": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64"
        },
        "product_reference": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all"
        },
        "product_reference": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all"
        },
        "product_reference": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64"
        },
        "product_reference": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64"
        },
        "product_reference": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all"
        },
        "product_reference": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all"
        },
        "product_reference": "bsdtar-0:3.2.2-3.1ubuntu0.7.all",
        "relates_to_product_reference": "Ubuntu-18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-30571",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
      },
      "notes": [
        {
          "category": "description",
          "text": "Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
          "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
          "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
          "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all",
          "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
          "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
          "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
          "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
          "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
          "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2023-30571"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/issues/1876",
          "url": "https://github.com/libarchive/libarchive/issues/1876"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/libarchive-announce",
          "url": "https://groups.google.com/g/libarchive-announce"
        }
      ],
      "release_date": "2023-05-29T20:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-08-18T14:36:41.732761Z",
          "details": "This is a local, high‑complexity race that only manifests in multi‑threaded applications using libarchive ≤ 3.6.2; single‑threaded archive tools are not affected, and triggering it reliably requires precise thread interleaving within the same process. Even when it occurs, the impact is limited to implicitly created directories by that process becoming 0777 (no sticky bit), enabling deletions/renames within those directories but not granting code execution or access to existing data. Because it demands a local account on the host plus a fragile, process‑internal race—conditions uncommon in server/VM workflows that run archive operations non‑interactively—the practical risk is low and this CVE can be safely deprioritized.",
          "product_ids": [
            "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
            "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
            "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
            "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all",
            "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
            "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
            "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
            "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
            "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
            "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
            "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
            "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
            "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all",
            "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
            "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
            "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
            "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
            "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
            "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}