Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
PEAR ArchiveTar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the ArchiveTar class. There are several file operations with $vheader['filename'] as parameter (such as fileexists, isfile, isdir, etc). When extract is called without a specific prefix path, we can trigger unserialization by crafting a tar file with phar://[pathtomaliciouspharfile] as path. Object injection can be used to trigger destruct in the loaded PHP classes, e.g. the ArchiveTar class itself. With ArchiveTar object injection, arbitrary file deletion can occur because @unlink($this-temptarname) is called. If another class with useful gadget is loaded, it may possible to cause remote code execution that can result in files being deleted or possibly modified. This vulnerability appears to have been fixed in 1.4.4.
Recommended action: Upgrade to 1.4.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Directory traversal vulnerability in PEAR::ArchiveTar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive.
Recommended action: Upgrade to 1.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
Recommended action: Upgrade to 1.4.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ArchiveTar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. See: https://github.com/pear/ArchiveTar/issues/33
Recommended action: Upgrade to 1.4.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. See: https://github.com/pear/ArchiveTar/issues/33
Recommended action: Upgrade to 1.4.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Tar.php in ArchiveTar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948. :exclamation: Note: There was an initial fix for this vulnerability made in version 1.4.12. That fix introduced a bug which was fixed in 1.4.13. Therefore we have set the first-patched-version to 1.4.13 which the earliest working version that avoids this vulnerability.
Recommended action: Upgrade to 1.4.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.