~ / search / GHSA-75c5-f4gw-38r9

GHSA-75c5-f4gw-38r9

Multiple vulnerabilities through filename manipulation in Archive_Tar

Source: GitHub Advisory Database (reviewed) High CVE-2020-28949

Packages

EcosystemPackageAffectedFixed in
Packagist pear/archive_tar < 1.4.11 1.4.11

Details

As written in the advisory (Markdown source, shown as plain text).

Archive_Tar through 1.4.10 has `://` filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as `file://` to overwrite files) can still succeed. See: https://github.com/pear/Archive_Tar/issues/33

References

External links from the advisory. They lead to third-party sites.