CVE-2020-7063: Files added to tar with Phar::buildFromIterator have all-access permissions
Fixed bug (Files added to tar with Phar::buildFromIterator have all-access permissions). (CVE-2020-7063)
Other sources
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php73-phpto a version that resolves this vulnerability.Fixed in 0:7.3.20-1.el7 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.2.28 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u5Fixed in 7.4.33-1+deb11u11 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.2.28 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.3.15 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.4.3
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this bug?
The vulnerability ID for this bug is CVE-2020-7063.
What is the severity level of CVE-2020-7063?
The severity level of CVE-2020-7063 is medium.
Which PHP versions are affected by CVE-2020-7063?
PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15, and 7.4.x below 7.4.3 are affected by CVE-2020-7063.
How can I fix CVE-2020-7063?
To fix CVE-2020-7063, you should update your PHP version to 7.2.28, 7.3.15, or 7.4.3 or higher.
Are there any references for CVE-2020-7063?
Yes, you can find more information about CVE-2020-7063 at the following references: [1](https://bugs.php.net/bug.php?id=79082), [2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1808537), [3](http://git.php.net/?p=php-src.git;a=commit;h=e5c95234d87fcb8f6b7569a96a89d1e1544749a6).