Hi,
we talked about it in version 1 but I forgot to mention it in commit.
Anyway this CVE was fixed in 3.8.9 by cherry-pick:
https://github.com/libarchive/libarchive/commit/22ffe8e8e459970f3bc86b0267493fc4aa8249b8
that is both on master and blacksail.
I can mark them fixed there if you would like to.

Best regards,
Jakub Szczudlo