CVE record
CVE-2020-28949
PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
CVE evidence
Known exploitation
Listed in CISA KEV
Absence from the fetched catalog does not establish that exploitation has not occurred.
Severity
high
CVSS 7.8 · CVSS_V3
Affected packages
2
Supported package records returned by OSV. Vendor and product names are not used to infer matches.
CISA Known Exploited Vulnerabilities
Catalog record
- Vendor / project
- PEAR
- Product
- Archive_Tar
- Date added
- Aug 25, 2022
- CISA federal remediation due date
- Sep 15, 2022
- Required action
- Apply updates per vendor instructions.
- Known ransomware campaign use
- Unknown
- CWE
- CWE-74
OSV package mapping
Affected open-source packages
| Package | Ecosystem | Fixed versions |
|---|---|---|
| drupal/core | composer | 8.8.12, 8.9.10, 9.0.9 |
| pear/archive_tar | composer | 1.4.11 |