Описание
Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| drupal7 | removed | package | ||
| php-pear | fixed | 1:1.10.9+submodules+notgz-1.1 | package |
Примечания
https://github.com/pear/Archive_Tar/issues/33
https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da
https://www.drupal.org/sa-core-2020-013
EPSS
Связанные уязвимости
Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
Deserialization of Untrusted Data in Archive_Tar
Уязвимость функции _maliciousFilename класса Archive_Tar библиотеки PHP классов PEAR, позволяющая нарушителю выполнить произвольный PHP-код
EPSS