CVE record

CVE-2020-28948

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

Known exploitation

Not listed in fetched KEV catalog

Absence from the fetched catalog does not establish that exploitation has not occurred.

Severity

high

CVSS 7.8 · CVSS_V3

Affected packages

Supported package records returned by OSV. Vendor and product names are not used to infer matches.

OSV package mapping

Affected open-source packages

Package	Ecosystem	Fixed versions
drupal/core	composer	8.8.12, 8.9.10, 9.0.9
pear/archive_tar	composer	1.4.11