Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 757246 (CVE-2020-28948, CVE-2020-28949)

Summary: [Tracker] Vulnerabilities in <dev-php/PEAR-Archive_Tar-1.4.11 (CVE-2020-{28948,28949})
Product: Gentoo Security Reporter: John Helmert III <ajak>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal Keywords: Tracker
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://www.drupal.org/sa-core-2020-013
See Also: https://bugs.gentoo.org/show_bug.cgi?id=766036
Whiteboard:
Package list:
Runtime testing required: ---
Bug Depends on: 755653, 757252    
Bug Blocks:    

Description John Helmert III gentoo-dev Security 2020-11-27 17:07:01 UTC
Drupal reports RCE via certain tarball archive upload due to CVE-2020-28948 and CVE-2020-28949.

CVE-2020-28948:

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

CVE-2020-28949:

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
Comment 1 John Helmert III gentoo-dev Security 2021-01-26 00:29:32 UTC
Dead tracker.