Drupal fixed a new flaw related PEAR Archive_Tar library
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-28948 | Archive_Tar through 1.4.10 allows an unserialization attack because phar: Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. NVD description · AI analysis pending | 7.8 | 47% | PoC |
| — | |
| CVE-2020-36193 | Symlink Directory Traversal File Write in PEAR Archive_Tar (PHP, Drupal, Debian, Fedora) PEAR Archive_Tar through 1.4.11 mishandles symbolic links when unpacking archives, allowing write operations with directory traversal (CWE-22/CWE-59; a related issue to CVE-2020-28948). An attacker who can get a vulnerable application to extract a crafted .tar archive can slip symlinks past the checks in Tar.php and write files outside the intended extraction directory with the privileges of the PHP process, an arbitrary file-write condition with high integrity impact and the potential for supply-chain-style compromise given how widely the library is embedded. Anyone running PHP applications that use Archive_Tar to unpack user-supplied archives is affected, including Drupal, which bundles the library, plus systems with the library packaged in Debian or Fedora. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-08-25, and EPSS estimates a ~71% probability of exploitation within 30 days (99th percentile). No public proof-of-concept is known, but KEV listing confirms observed exploitation in the wild. Do: Upgrade PEAR Archive_Tar to 1.4.12 or later (the first release after the affected range through 1.4.11) and pull in the corresponding updates from Debian, Fedora, and Drupal per vendor advisories. Audit whether your PHP applications extract user-supplied .tar archives via Archive_Tar and, until patched, restrict or validate symlink handling in extraction paths. This vulnerability is on CISA's KEV list, so apply the required vendor updates promptly. | 7.5 | 71% | KEV |
| mass≈1,000,000+ installations (Drupal's roughly one-million-site install base alone, plus Archive_Tar packaged in Debian/Fedora and bundled across the PHP… |
Full article305 words · extracted from securityaffairs.com · click to collapse
Drupal development team released security updates to address a vulnerability that resides in the PEAR Archive_Tar third-party library.
The Drupal development team has released security updates to address the CVE-2020-36193 vulnerability in the PEAR Archive_Tar third-party library.
The PEAR Archive_Tar class provides handling of tar files in PHP. It supports creating, listing, extracting, and adding to tar files.
The developers released core patches for the version 9.1, 9.0, 8.9, and 7 of the popular CMS.
The CVE-2020-36193 flaw is caused by the improper check of symbolic links, leading to Tar.php in Archive_Tar allowing for write operations with directory traversal.
“The Drupal project uses the pear Archive_Tar library, which has released a security update that impacts Drupal.” reads the advisory.
The flaw could be exploited by attackers if the CMS is configured to allow for the upload and processing of .tar, .tar.gz, .bz2, or .tlz files.
The flaw affects Archive_Tar through version 1.4.11, the issue was fixed by disallowing symlinks to out-of-path filenames.
According to the advisory published by Drupal, the flaw could be mitigated by disabling uploads of .tar, .tar.gz, .bz2, or .tlz files.
The development team recommends to install the latest version
- If you are using version 9.1, update to Drupal 9.1.3.
- If you are using version 9.0, update to Drupal 9.0.11.
- If you are using version 8.9, update to 8.9.13.
- If you are using version 7, update to 7.78.
Versions of Drupal 8 prior to 8.9.x are end-of-life and do not receive security coverage.
The CVE-2020-36193 vulnerability is linked to the CVE-2020-28948 flaw that was fixed by the developers in November with the release of emergency security updates.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/113718/security/drupal-pear-archive_tar-library-flaw.html