CVE-2020-28948: Deserialization of Untrusted Data in Archive_Tar
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. See: https://github.com/pear/ArchiveTar/issues/33
Other sources
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
Deserialization of Untrusted Data in ArchiveTar
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/php-pearto a version that resolves this vulnerability.Fixed in 1:1.9.4-23.el7_9 - Upgrade
Upgrade
redhat/Archive_Tarto a version that resolves this vulnerability.Fixed in 1.4.11 - Upgrade
Upgrade
debian/php-pearto a version that resolves this vulnerability.Fixed in 1:1.10.12+submodules+notgz+20210212-1Fixed in 1:1.10.13+submodules+notgz+2022032202-2 - Upgrade
Upgrade
composer/pear/archive_tarto a version that resolves this vulnerability.Fixed in 1.4.11 - Upgrade
Upgrade
alpine/drupal7to a version that resolves this vulnerability.Fixed in 7.75-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-28948.
What is the severity of CVE-2020-28948?
The severity of CVE-2020-28948 is high, with a severity value of 7.8.
Which software is affected by CVE-2020-28948?
The software affected by CVE-2020-28948 includes Archive_Tar versions up to 1.4.10, php-pear versions up to 1:1.9.4-23.el7_9, and certain versions of Drupal, Debian, and Fedora.
How can I fix CVE-2020-28948?
To fix CVE-2020-28948, update to Archive_Tar version 1.4.11 or later, php-pear version 1:1.9.4-23.el7_9 or later, or the specified patched versions of Drupal, Debian, and Fedora.
Where can I find more information about CVE-2020-28948?
You can find more information about CVE-2020-28948 at the following references: [link1], [link2], [link3].