{"id":"CVE-2020-28948","published":"2020-11-19T18:14:33Z","modified":"2024-08-04T16:48:00Z","title":"Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked","vendor":null,"product":null,"tier":"tail","description":{"text":"Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.47493,"percentile":0.98838,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/pear/Archive_Tar/issues/33","tags":["x_refsource_MISC"]},{"url":"https://www.drupal.org/sa-core-2020-013","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://www.debian.org/security/2020/dsa-4817","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://security.gentoo.org/glsa/202101-23","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":24.8,"factors":[{"name":"EPSS percentile","points":19.77},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"pocGithub":{"count":1,"skipped":2,"earliest":"2020-11-27","earliestUrl":"https://github.com/0x240x23elu/CVE-2020-28948-and-CVE-2020-28949","repos":[{"name":"0x240x23elu/CVE-2020-28948-and-CVE-2020-28949","url":"https://github.com/0x240x23elu/CVE-2020-28948-and-CVE-2020-28949","stars":6,"created":"2020-11-27"}]},"first":{"date":"2020-11-27","source":"PoC-in-GitHub","url":"https://github.com/0x240x23elu/CVE-2020-28948-and-CVE-2020-28949"},"provenance":"source"},"affected":[{"ecosystem":"Packagist","package":"pear/archive_tar","vulnerableRanges":["<1.4.11"],"patched":["1.4.11"],"from":["GHSA-jh5x-hfhg-78jq"],"provenance":"source"},{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0.0, <8.8.12",">=8.9.0, <8.9.10",">=9.0.0, <9.0.9"],"patched":["8.8.12","8.9.10","9.0.9"],"from":["DRUPAL-CORE-2020-013"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0841","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pear-archive-tar-cve-2018-1000888","parents":[{"from":"CVE-2018-1000888","to":"CVE-2020-28948","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pear/archive_tar","fromFixed":"1.4.4","toFixed":"1.4.11","daysApart":693},{"kind":"same-code","provenance":"machine","files":["Archive/Tar.php"],"commits":["https://github.com/pear/Archive_Tar/commit/59ace120ac5ceb5f0d36e40e48e1884de1badf76","https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da"],"basis":"shared function","functions":["_tarRecToSize"]}]}],"children":[{"from":"CVE-2020-28948","to":"CVE-2020-36193","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.","from":"NVD","in":"CVE-2020-36193"},{"kind":"same-code","provenance":"machine","files":["Archive/Tar.php"],"commits":["https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da","https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916"],"basis":"shared file"}]}],"packageHistory":[{"cve":"CVE-2020-13670","published":"2022-02-11","fixed":"9.0.6","kev":false},{"cve":"CVE-2020-13688","published":"2021-06-11","fixed":"9.0.6","kev":false},{"cve":"CVE-2020-13671","published":"2020-11-20","fixed":"9.0.8","kev":true,"link":{"from":"CVE-2020-13671","to":"CVE-2020-28948","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"9.0.8","toFixed":"9.0.9","daysApart":-1},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"8.8.11","toFixed":"8.8.12","daysApart":-1}]}},{"cve":"CVE-2020-28948","published":"2020-11-19","fixed":"9.0.9","kev":false},{"cve":"CVE-2020-28949","published":"2020-11-19","fixed":"9.0.9","kev":true},{"cve":"CVE-2020-13672","published":"2022-02-11","fixed":"9.1.7","kev":false},{"cve":"CVE-2021-33829","published":"2021-06-09","fixed":"9.1.9","kev":false}],"package":"Packagist:drupal/core"}}