GitHub Advisoryadvisory · Packagist

GHSA-jh5x-hfhg-78jq Deserialization of Untrusted Data in Archive_Tar

HIGH Published 2021-04-22 Modified 2023-07-05 Official page ↗
Aliases
CVE-2020-28948
Ecosystem
Packagist
Packages
pear/archive_tar
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2021-03-23

Affected packages

• Packagist pear/archive_tar: < 1.4.11 → fixed in 1.4.11

Description

Archive_Tar through 1.4.10 allows an unserialization attack because `phar:` is blocked but `PHAR:` is not blocked. See: https://github.com/pear/Archive_Tar/issues/33

Related

Alias · CVE (1)

  • CVE-2020-28948 Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References