PEAR · Archive_Tar
CVE-2020-36193
PEAR Archive_Tar Improper Link Resolution Vulnerability
What it is
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
CISA: PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: September 15, 2022
- Added to the CISA list
- August 25, 2022
- Published
- January 18, 2021
- Severity
- High 7.5 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 71% in the top 0.6% of all known vulnerabilities
- Weakness
- CWE-22 CWE-59
- More details
- NVD · CVE.org · CISA
All references (10)
- https://security.gentoo.org/glsa/202101-23
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7F…
- https://www.debian.org/security/2021/dsa-4894
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJY…
- https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916
- https://www.drupal.org/sa-core-2021-001
- https://lists.debian.org/debian-lts-announce/2021/01/msg00018.html
- https://lists.debian.org/debian-lts-announce/2021/04/msg00007.html
More exploited flaws from PEAR
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 25, 2022 | Deserialization of Untrusted Data | Archive_Tar | High 7.8 | 85% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.