CVE-2020-28949

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

https://pear.php.net/bugs/bug.php?id=27002, https://www.drupal.org/sa-core-2020-013, https://access.redhat.com/security/cve/cve-2020-28949; https://nvd.nist.gov/vuln/detail/CVE-2020-28949

Remediation deadline: September 15, 2022

Description

PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.

Timeline

Published:August 25th, 2022 12:00 AM

Last modified:August 25th, 2022 12:00 AM

Added to KEV:August 25th, 2022

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

PEAR

Products

Archive_Tar

Weaknesses (CWE)

CWE-74

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute