~ / search / GHSA-jh5x-hfhg-78jq

GHSA-jh5x-hfhg-78jq

Deserialization of Untrusted Data in Archive_Tar

Source: GitHub Advisory Database (reviewed) High CVE-2020-28948

Packages

EcosystemPackageAffectedFixed in
Packagist pear/archive_tar < 1.4.11 1.4.11

Details

As written in the advisory (Markdown source, shown as plain text).

Archive_Tar through 1.4.10 allows an unserialization attack because `phar:` is blocked but `PHAR:` is not blocked. See: https://github.com/pear/Archive_Tar/issues/33

References

External links from the advisory. They lead to third-party sites.