Name: CVE-2020-28949: Undefined Security Weakness
Creator: Rapid7
Published: 2020-11-19T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2020-28949, CWE-74, Exploited in the Wild, CISA KEV Exploit, Metasploit Module, CVSS 7.8, EPSS 0.92961, CISA KEV

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

CVSS Details

CVSS 3.1 Base Score: 7.8
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade php-mysqlndUpgrade php-bcmathUpgrade php-pdoUpgrade php-snmpUpgrade php-ffiUpgrade libzip-develUpgrade php-gmpUpgrade apcu-panelUpgrade php-gdUpgrade php-pecl-apcuUpgrade php-embeddedUpgrade php-dbgUpgrade php-cliUpgrade php-pecl-zipUpgrade php-odbcUpgrade php-ldapUpgrade php-enchantUpgrade libzipUpgrade phpUpgrade php-opcacheUpgrade php-jsonUpgrade php-intlUpgrade php-soapUpgrade php-commonUpgrade php-fpmUpgrade libzip-toolsUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-pecl-apcu-develUpgrade php-dbaUpgrade php-pecl-xdebugUpgrade php-pearUpgrade php-develUpgrade php-pecl-rrdUpgrade php-pgsqlUpgrade php-mbstringUpgrade php-process	Oct 20, 2022	Nov 19, 2020
Alpine Linux	—	Upgrade drupal7	Aug 22, 2024	Nov 19, 2020
Amazon Linux Ami 2	—	Upgrade php-pear	Jan 8, 2021	Nov 19, 2020
Amazon_linux	—	Upgrade php7-pear	Jan 15, 2021	Nov 19, 2020
Centos_linux	—	Upgrade php-pgsql-debuginfoUpgrade php-pecl-zipUpgrade php-gdUpgrade php-processUpgrade php-ldap-debuginfoUpgrade php-pecl-rrdUpgrade php-embeddedUpgrade php-gmp-debuginfoUpgrade phpUpgrade php-bcmathUpgrade apcu-panelUpgrade php-mysqlndUpgrade php-enchantUpgrade php-pecl-rrd-debugsourceUpgrade php-xmlrpcUpgrade php-pecl-apcu-debuginfoUpgrade php-intl-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-mbstringUpgrade libzipUpgrade php-opcacheUpgrade php-pearUpgrade php-pecl-rrd-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-cliUpgrade php-snmpUpgrade php-xmlUpgrade php-xmlrpc-debuginfoUpgrade php-soap-debuginfoUpgrade libzip-develUpgrade libzip-toolsUpgrade php-pecl-xdebugUpgrade php-gd-debuginfoUpgrade php-fpmUpgrade php-debugsourceUpgrade php-develUpgrade php-ffiUpgrade php-dbg-debuginfoUpgrade php-embedded-debuginfoUpgrade php-snmp-debuginfoUpgrade php-json-debuginfoUpgrade php-pgsqlUpgrade php-pecl-xdebug-debuginfoUpgrade php-process-debuginfoUpgrade php-opcache-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-dbgUpgrade php-cli-debuginfoUpgrade php-pdo-debuginfoUpgrade php-odbc-debuginfoUpgrade php-gmpUpgrade php-intlUpgrade php-pecl-apcuUpgrade php-ldapUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-jsonUpgrade php-fpm-debuginfoUpgrade php-debuginfoUpgrade php-ffi-debuginfoUpgrade php-dbaUpgrade php-commonUpgrade php-soapUpgrade php-pecl-apcu-develUpgrade php-common-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-odbcUpgrade php-pdoUpgrade php-xml-debuginfoUpgrade php-mbstring-debuginfoUpgrade libzip-debuginfoUpgrade php-dba-debuginfoUpgrade php-enchant-debuginfo	Oct 20, 2022	Nov 19, 2020
Debian	—	Upgrade php-pear	Nov 24, 2020	Nov 19, 2020
Drupal	—	Upgrade to drupal version 9.0.9Upgrade to drupal version 8.9.1Upgrade to drupal version 8.8.1Upgrade to drupal version 7.75	Nov 27, 2020	Nov 19, 2020
Gentoo Linux	—	Upgrade dev-php/PEAR-Archive_Tar.	Jan 26, 2021	Nov 19, 2020
Huawei Euleros 2_0_sp2	—	Upgrade php-pear	Feb 22, 2021	Nov 19, 2020
Huawei Euleros 2_0_sp3	—	Upgrade php-pear	Jan 20, 2021	Nov 19, 2020
Huawei Euleros 2_0_sp8	—	Upgrade php-pear	Feb 2, 2021	Nov 19, 2020
Oracle Solaris	—	Upgrade web/php-74 to version 7.4.15-11.4.32.0.1.88.2 on Solaris 11.4Upgrade web/php-80 to version 8.0.2-11.4.33.0.1.94.0 on Solaris 11.4Upgrade web/php-73 to version 7.3.27-11.4.32.0.1.88.2 on Solaris 11.4	Apr 21, 2021	Nov 19, 2020
Oracle_linux	—	Upgrade php-pgsqlUpgrade php-snmpUpgrade php-dbgUpgrade php-commonUpgrade php-ldapUpgrade php-intlUpgrade php-bcmathUpgrade php-ffiUpgrade libzip-develUpgrade php-pecl-apcuUpgrade apcu-panelUpgrade php-fpmUpgrade php-xmlUpgrade phpUpgrade php-odbcUpgrade php-develUpgrade php-opcacheUpgrade php-pearUpgrade libzipUpgrade php-enchantUpgrade php-xmlrpcUpgrade php-pecl-rrdUpgrade php-cliUpgrade php-processUpgrade php-mbstringUpgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-dbaUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-jsonUpgrade php-gdUpgrade libzip-toolsUpgrade php-pecl-zipUpgrade php-soap	Sep 17, 2022	Nov 19, 2020
Redhat_linux	—	Upgrade php-pearNo solution existsUpgrade php-opcacheUpgrade libzip-toolsUpgrade libzip-debuginfoUpgrade php-snmpUpgrade php-ldapUpgrade php-pgsql-debuginfoUpgrade libzip-develUpgrade php-bcmath-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-json-debuginfoUpgrade php-commonUpgrade php-pecl-apcuUpgrade php-odbcUpgrade php-fpmUpgrade apcu-panelUpgrade php-cliUpgrade php-enchant-debuginfoUpgrade php-ffiUpgrade php-dbgUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-opcache-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-mbstringUpgrade php-xmlUpgrade php-common-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-mysqlndUpgrade php-pecl-xdebugUpgrade php-xml-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-soap-debuginfoUpgrade php-debuginfoUpgrade libzipUpgrade php-dbg-debuginfoUpgrade php-bcmathUpgrade php-odbc-debuginfoUpgrade php-xmlrpcUpgrade php-pdo-debuginfoUpgrade php-embedded-debuginfoUpgrade php-develUpgrade libzip-debugsourceUpgrade php-gd-debuginfoUpgrade php-gmp-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-gdUpgrade php-snmp-debuginfoUpgrade php-intlUpgrade php-embeddedUpgrade php-process-debuginfoUpgrade php-debugsourceUpgrade php-gmpUpgrade php-soapUpgrade php-intl-debuginfoUpgrade php-fpm-debuginfoUpgrade phpUpgrade php-pgsqlUpgrade php-ffi-debuginfoUpgrade php-pecl-apcu-develUpgrade php-jsonUpgrade php-pecl-zipUpgrade php-pecl-zip-debugsourceUpgrade php-processUpgrade php-xmlrpc-debuginfoUpgrade php-enchantUpgrade libzip-tools-debuginfoUpgrade php-pecl-rrdUpgrade php-ldap-debuginfoUpgrade php-pdoUpgrade php-pecl-xdebug-debuginfoUpgrade php-cli-debuginfoUpgrade php-dba	Oct 20, 2022	Nov 19, 2020
Rocky_linux	—	Upgrade libzipUpgrade php-cliUpgrade php-dbgUpgrade php-pecl-zip-debuginfoUpgrade php-embedded-debuginfoUpgrade php-xmlUpgrade php-bcmath-debuginfoUpgrade php-debuginfoUpgrade php-gmp-debuginfoUpgrade libzip-toolsUpgrade php-mysqlndUpgrade php-intlUpgrade php-pecl-apcu-debugsourceUpgrade php-soap-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-gd-debuginfoUpgrade php-snmp-debuginfoUpgrade php-fpm-debuginfoUpgrade php-ldapUpgrade php-debugsourceUpgrade phpUpgrade libzip-develUpgrade php-pgsql-debuginfoUpgrade php-opcacheUpgrade php-embeddedUpgrade php-process-debuginfoUpgrade php-ffi-debuginfoUpgrade php-ffiUpgrade php-snmpUpgrade php-pecl-rrd-debugsourceUpgrade php-enchantUpgrade php-pecl-xdebug-debugsourceUpgrade php-gmpUpgrade php-mbstringUpgrade php-pecl-apcu-develUpgrade php-intl-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcuUpgrade php-gdUpgrade php-fpmUpgrade php-dba-debuginfoUpgrade php-common-debuginfoUpgrade php-dbaUpgrade libzip-debuginfoUpgrade php-xml-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-processUpgrade php-pecl-xdebugUpgrade php-pdo-debuginfoUpgrade php-pdoUpgrade php-odbc-debuginfoUpgrade php-json-debuginfoUpgrade php-soapUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-rrdUpgrade php-odbcUpgrade php-commonUpgrade libzip-tools-debuginfoUpgrade php-cli-debuginfoUpgrade php-pecl-zipUpgrade php-jsonUpgrade php-dbg-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-bcmathUpgrade php-xmlrpc-debuginfoUpgrade libzip-debugsourceUpgrade php-opcache-debuginfoUpgrade php-enchant-debuginfoUpgrade php-develUpgrade php-xmlrpcUpgrade php-pgsql	Mar 12, 2024	Nov 19, 2020
Ubuntu	—	Upgrade drupal7 (Ubuntu Pro)Upgrade php-pear	Dec 2, 2020	Nov 19, 2020

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence