GHSA-jh5x-hfhg-78jq

Deserialization of Untrusted Data in Archive_Tar

En bref

Publiée: 2021-04-22 16:20 UTC
Mise à jour: 2025-12-10 23:40 UTC
CVE: CVE-2020-28948, CVE-2020-28949
Alias: BIT-drupal-2020-28948, BIT-drupal-2020-28949, DRUPAL-CORE-2020-013, GHSA-75c5-f4gw-38r9
CVSS_V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Archive_Tar through 1.4.10 allows an unserialization attack because `phar:` is blocked but `PHAR:` is not blocked. See: https://github.com/pear/Archive_Tar/issues/33

Paquets affectés

Paquet	Versions
Packagist · pear/archive_tar	introduced 0, fixed 1.4.11

Références

https://nvd.nist.gov/vuln/detail/CVE-2020-28948 ADVISORY
https://github.com/pear/Archive_Tar/issues/33 WEB
https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da WEB
https://github.com/pear/Archive_Tar PACKAGE
https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437 WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N WEB
https://security.gentoo.org/glsa/202101-23 WEB
https://www.debian.org/security/2020/dsa-4817 WEB
https://www.drupal.org/sa-core-2020-013 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database