logo

Database

Lack of data validation In pear/archive_tar

Description

Multiple vulnerabilities through filename manipulation in Archive_Tar Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. See: https://github.com/pear/Archive_Tar/issues/33

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 12

10

Aliases

1. CVE-2020-289492. NVD-2020-289493. OSV-2020-289494. OSV-DEBIAN-2020-289495. GCVE-2020-289496. security.gentoo.org7. lists.debian.org8. SECURITY-TRACKER-CVE-2020-28949

References

1. https://github.com/pear/Archive_Tar/issues/332. http://packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.html3. https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da4. https://www.drupal.org/sa-core-2020-0135. https://www.debian.org/security/2020/dsa-48176. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-289497. https://lists.fedoraproject.org/archives/list/[email protected]/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N8. https://lists.fedoraproject.org/archives/list/[email protected]/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP9. https://lists.fedoraproject.org/archives/list/[email protected]/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT10. https://lists.fedoraproject.org/archives/list/[email protected]/message/5KSFM672XW3X6BR7TVKRD63SLZGKK43711. https://lists.fedoraproject.org/archives/list/[email protected]/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B12. https://lists.fedoraproject.org/archives/list/[email protected]/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR13. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N14. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP15. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT16. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK43717. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B18. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR19. https://github.com/FriendsOfPHP/security-advisories/blob/master/pear/archive_tar/CVE-2020-28949.yaml20. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/fileformat/archive_tar_arb_file_write.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.