CVE-2020-36193

Опубликовано: 18 янв. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Высокий

Описание

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

Ссылки

https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916
Patch
https://lists.debian.org/debian-lts-announce/2021/01/msg00018.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00007.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/
Broken Link
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2/
Broken Link
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/
Broken Link
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/
Broken Link
https://security.gentoo.org/glsa/202101-23
Third Party Advisory
https://www.debian.org/security/2021/dsa-4894
Third Party Advisory
https://www.drupal.org/sa-core-2021-001
Third Party Advisory
https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916
Patch
https://lists.debian.org/debian-lts-announce/2021/01/msg00018.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00007.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/
Broken Link
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2/
Broken Link
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/
Broken Link
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/
Broken Link
https://security.gentoo.org/glsa/202101-23
Third Party Advisory
https://www.debian.org/security/2021/dsa-4894
Third Party Advisory
https://www.drupal.org/sa-core-2021-001
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:php:archive_tar:*:*:*:*:*:*:*:*

Версия до 1.4.11 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Версия от 7.0 (включая) до 7.78 (исключая)

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Версия от 8.9.0 (включая) до 8.9.13 (исключая)

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Версия от 9.0.0 (включая) до 9.0.11 (исключая)

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Версия от 9.1.0 (включая) до 9.1.3 (исключая)

EPSS

Процентиль: 99%

0.81263

Высокий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

CWE-59

Связанные уязвимости

CVE-2020-36193

CVSS3: 7.5

ubuntu

больше 4 лет назад

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

CVE-2020-36193

CVSS3: 7.5

redhat

больше 4 лет назад

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

CVE-2020-36193

CVSS3: 7.5

debian

больше 4 лет назад

Tar.php in Archive_Tar through 1.4.11 allows write operations with Dir ...

openSUSE-SU-2021:3018-1

suse-cvrf

почти 4 года назад

Security update for php7-pear

openSUSE-SU-2021:2872-1

suse-cvrf

почти 4 года назад

Security update for php7

EPSS

Процентиль: 99%

0.81263

Высокий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

CWE-59