Patchfirst
Patchfirst
ChainPEAR · Archive_TarPackagist:pear/archive_tar

PEAR Archive_Tar: successive fixes (2018–2021)

5 CVEs over 4 generations, 27 Dec 2018 to 27 Jul 2021. 2 are in .

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2018-100088827 Dec 2018 First in the chain
  2. CVE-2020-2894819 Nov 2020 related to CVE-2018-1000888
  3. CVE-2020-2894919 Nov 2020KEV related to CVE-2018-1000888
  4. CVE-2020-3619318 Jan 2021KEV next fix after CVE-2020-28949related to CVE-2020-28948
  5. CVE-2021-3261027 Jul 2021 related to CVE-2020-36193
Dec 2018Oct 2019Oct 2020Jan 2021AprJul CVE-2018-1000888 → CVE-2020-28948: related (high confidence)CVE-2018-1000888 → CVE-2020-28949: related (high confidence)CVE-2020-28949 → CVE-2020-36193: Next fix in the same package (high confidence)CVE-2020-36193 → CVE-2021-32610: related (high confidence)CVE-2020-28948 → CVE-2020-36193: related (medium confidence) CVE-2018-1000888 27 Dec 2018 CVE-2020-28948 19 Nov 2020 CVE-2020-28949 19 Nov 2020 CVE-2020-36193 18 Jan 2021 CVE-2021-32610 27 Jul 2021 Dec 2018Jul 2019Jan 2020OctJan 2021AprJul CVE-2018-1000888 → CVE-2020-28948: related (high confidence)CVE-2018-1000888 → CVE-2020-28949: related (high confidence)CVE-2020-28949 → CVE-2020-36193: Next fix in the same package (high confidence)CVE-2020-36193 → CVE-2021-32610: related (high confidence)CVE-2020-28948 → CVE-2020-36193: related (medium confidence) CVE-2018-1000888 27 Dec 2018 CVE-2020-28948 19 Nov 2020 CVE-2020-28949 19 Nov 2020 CVE-2020-36193 18 Jan 2021 CVE-2021-32610 27 Jul 2021
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2018-1000888 27 Dec 2018 PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class · fixed in 1.4.4 First in chain 24.5
CVE-2020-28948 19 Nov 2020 Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked · fixed in 1.4.11 CVE-2018-1000888 · related · High 24.8
CVE-2020-28949KEV 19 Nov 2020 PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability · fixed in 9.0.9 CVE-2018-1000888 · related · High 78.4
CVE-2020-36193KEV 18 Jan 2021 PEAR Archive_Tar Improper Link Resolution Vulnerability · fixed in 1.4.13 CVE-2020-28949 · Next fix in the same package · High 73.1
CVE-2021-32610 27 Jul 2021 In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different… · fixed in 9.2.2 CVE-2020-36193 · related · High 19.9
↑ ↓ chooseEnter openEsc close