Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTc1YzUtZjRndy0zOHI5

Multiple vulnerabilities through filename manipulation in Archive_Tar

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. See: https://github.com/pear/Archive_Tar/issues/33

Permalink: https://github.com/advisories/GHSA-75c5-f4gw-38r9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTc1YzUtZjRndy0zOHI5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 3 years ago
Updated: 12 months ago


CVSS Score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-75c5-f4gw-38r9, CVE-2020-28949
References: Repository: https://github.com/pear/Archive_Tar
Blast Radius: 28.7

Affected Packages

packagist:pear/archive_tar
Dependent packages: 70
Dependent repositories: 4,758
Downloads: 39,425,463 total
Affected Version Ranges: < 1.4.11
Fixed in: 1.4.11
All affected versions: 1.3.11, 1.3.12, 1.3.13, 1.3.14, 1.3.15, 1.3.16, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.4.9, 1.4.10
All unaffected versions: 1.4.11, 1.4.12, 1.4.13, 1.4.14, 1.5.0