cyfenced.com →

[ CVE-2020-28949 · Published 19 Nov 2020 ]

PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability

Exploited · CISA KEV CVSS 7.8 EPSS 85%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-08-25
  • EPSS: 85% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

CISA: PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Sep 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References