PEAR · Archive_Tar
CVE-2020-28949
PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
What it is
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
CISA: PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: September 15, 2022
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedora…
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedora…
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedora…
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedora…
- debian.org/security/2020/dsa-4817
- Added to the CISA list
- August 25, 2022
- Published
- November 19, 2020
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 85% in the top 0.3% of all known vulnerabilities
- Weakness
- CWE-74
- More details
- NVD · CVE.org · CISA
All references (12)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBC…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X…
- https://www.debian.org/security/2020/dsa-4817
- https://security.gentoo.org/glsa/202101-23
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJY…
- https://github.com/pear/Archive_Tar/issues/33
- https://www.drupal.org/sa-core-2020-013
- https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html
- http://packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.html
More exploited flaws from PEAR
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 25, 2022 | Improper Link Resolution | Archive_Tar | High 7.5 | 71% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.