Name: CVE-2020-28949: Undefined Security Weakness
Creator: Rapid7
Published: 2020-11-19T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2020-28949, CWE-74, Exploited in the Wild, CISA KEV Exploit, Metasploit Module, CVSS 7.8, EPSS 0.84554, CISA KEV

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

CVSS Details

CVSS 3.1 Base Score: 7.8
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade php-xmlUpgrade php-pecl-rrdUpgrade php-pgsqlUpgrade php-dbaUpgrade php-pecl-apcu-develUpgrade php-pearUpgrade php-commonUpgrade php-develUpgrade php-fpmUpgrade php-xmlrpcUpgrade libzip-toolsUpgrade php-pecl-xdebugUpgrade php-mbstringUpgrade php-processUpgrade php-gdUpgrade php-ldapUpgrade php-cliUpgrade php-pecl-zipUpgrade php-pdoUpgrade libzip-develUpgrade php-ffiUpgrade php-opcacheUpgrade php-snmpUpgrade php-intlUpgrade php-gmpUpgrade php-bcmathUpgrade php-mysqlndUpgrade php-enchantUpgrade libzipUpgrade php-jsonUpgrade phpUpgrade php-odbcUpgrade php-dbgUpgrade php-embeddedUpgrade php-soapUpgrade apcu-panelUpgrade php-pecl-apcu	Oct 20, 2022	Nov 19, 2020
Alpine Linux	—	Upgrade drupal7	Aug 22, 2024	Nov 19, 2020
Amazon Linux Ami 2	—	Upgrade php-pear	Jan 8, 2021	Nov 19, 2020
Amazon_linux	—	Upgrade php7-pear	Jan 15, 2021	Nov 19, 2020
Centos_linux	—	Upgrade php-gmpUpgrade php-xml-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-debuginfoUpgrade php-pgsqlUpgrade php-fpm-debuginfoUpgrade libzip-debugsourceUpgrade php-process-debuginfoUpgrade php-opcache-debuginfoUpgrade php-ldapUpgrade php-pecl-apcu-develUpgrade php-soapUpgrade php-ffi-debuginfoUpgrade php-commonUpgrade php-mysqlnd-debuginfoUpgrade php-dbaUpgrade php-common-debuginfoUpgrade php-intlUpgrade php-odbc-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-cli-debuginfoUpgrade php-dba-debuginfoUpgrade php-dbgUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-odbcUpgrade php-pdoUpgrade php-pecl-apcuUpgrade php-json-debuginfoUpgrade php-jsonUpgrade php-pecl-xdebug-debugsourceUpgrade libzip-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-mbstringUpgrade php-soap-debuginfoUpgrade php-ffiUpgrade php-embedded-debuginfoUpgrade php-dbg-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-snmp-debuginfoUpgrade php-xmlrpcUpgrade php-intl-debuginfoUpgrade phpUpgrade apcu-panelUpgrade libzipUpgrade php-xmlrpc-debuginfoUpgrade php-xmlUpgrade php-opcacheUpgrade php-bcmath-debuginfoUpgrade php-pearUpgrade php-ldap-debuginfoUpgrade php-gdUpgrade php-embeddedUpgrade php-pgsql-debuginfoUpgrade php-pecl-zipUpgrade php-pecl-rrdUpgrade php-bcmathUpgrade php-gmp-debuginfoUpgrade php-enchantUpgrade php-develUpgrade php-mysqlndUpgrade php-processUpgrade php-debugsourceUpgrade libzip-develUpgrade libzip-toolsUpgrade php-snmpUpgrade php-fpmUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebugUpgrade php-gd-debuginfoUpgrade php-cli	Oct 20, 2022	Nov 19, 2020
Debian	—	Upgrade php-pear	Nov 24, 2020	Nov 19, 2020
Drupal	—	Upgrade to drupal version 9.0.9Upgrade to drupal version 8.9.1Upgrade to drupal version 8.8.1Upgrade to drupal version 7.75	Nov 27, 2020	Nov 19, 2020
Gentoo Linux	—	Upgrade dev-php/PEAR-Archive_Tar.	Jan 26, 2021	Nov 19, 2020
Huawei Euleros 2_0_sp2	—	Upgrade php-pear	Feb 22, 2021	Nov 19, 2020
Huawei Euleros 2_0_sp3	—	Upgrade php-pear	Jan 20, 2021	Nov 19, 2020
Huawei Euleros 2_0_sp8	—	Upgrade php-pear	Feb 2, 2021	Nov 19, 2020
Oracle Solaris	—	Upgrade web/php-73 to version 7.3.27-11.4.32.0.1.88.2 on Solaris 11.4Upgrade web/php-80 to version 8.0.2-11.4.33.0.1.94.0 on Solaris 11.4Upgrade web/php-74 to version 7.4.15-11.4.32.0.1.88.2 on Solaris 11.4	Apr 21, 2021	Nov 19, 2020
Oracle_linux	—	Upgrade php-pecl-apcuUpgrade php-ldapUpgrade php-commonUpgrade php-snmpUpgrade apcu-panelUpgrade php-develUpgrade libzip-develUpgrade php-pgsqlUpgrade php-ffiUpgrade phpUpgrade php-xmlUpgrade php-odbcUpgrade php-fpmUpgrade php-bcmathUpgrade php-dbgUpgrade php-intlUpgrade php-gmpUpgrade php-pearUpgrade php-dbaUpgrade php-mysqlndUpgrade php-enchantUpgrade php-opcacheUpgrade php-embeddedUpgrade php-pecl-rrdUpgrade php-pecl-xdebugUpgrade php-mbstringUpgrade php-soapUpgrade libzip-toolsUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-jsonUpgrade php-gdUpgrade php-cliUpgrade libzipUpgrade php-xmlrpcUpgrade php-pecl-zipUpgrade php-process	Sep 17, 2022	Nov 19, 2020
Redhat_linux	—	Upgrade php-pearUpgrade php-enchant-debuginfoUpgrade php-cliUpgrade php-pecl-rrd-debugsourceUpgrade libzip-toolsUpgrade php-bcmath-debuginfoNo solution existsUpgrade php-odbcUpgrade php-xml-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-mbstringUpgrade php-pecl-xdebugUpgrade php-commonUpgrade php-soap-debuginfoUpgrade apcu-panelUpgrade php-mysqlndUpgrade php-ffiUpgrade libzip-debuginfoUpgrade php-ldapUpgrade php-common-debuginfoUpgrade php-xmlUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-apcuUpgrade php-debuginfoUpgrade php-snmpUpgrade php-mbstring-debuginfoUpgrade php-opcacheUpgrade php-fpmUpgrade libzip-develUpgrade php-dbgUpgrade php-opcache-debuginfoUpgrade php-dba-debuginfoUpgrade php-json-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-intl-debuginfoUpgrade php-processUpgrade php-dbg-debuginfoUpgrade php-snmp-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-rrdUpgrade php-bcmathUpgrade php-embedded-debuginfoUpgrade php-pdo-debuginfoUpgrade php-develUpgrade libzip-tools-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pecl-zipUpgrade phpUpgrade php-pecl-zip-debugsourceUpgrade php-ldap-debuginfoUpgrade php-pdoUpgrade php-enchantUpgrade php-cli-debuginfoUpgrade php-debugsourceUpgrade php-gmpUpgrade php-jsonUpgrade libzipUpgrade php-fpm-debuginfoUpgrade php-dbaUpgrade php-process-debuginfoUpgrade php-intlUpgrade php-embeddedUpgrade php-xmlrpc-debuginfoUpgrade php-gd-debuginfoUpgrade php-xmlrpcUpgrade libzip-debugsourceUpgrade php-gdUpgrade php-soapUpgrade php-gmp-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pecl-xdebug-debuginfoUpgrade php-pgsqlUpgrade php-pecl-apcu-debuginfo	Oct 20, 2022	Nov 19, 2020
Rocky_linux	—	Upgrade php-soap-debuginfoUpgrade php-fpm-debuginfoUpgrade php-intlUpgrade php-opcacheUpgrade php-bcmath-debuginfoUpgrade php-dbgUpgrade php-embeddedUpgrade php-embedded-debuginfoUpgrade php-gd-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-xmlUpgrade php-cliUpgrade php-ffiUpgrade php-snmpUpgrade php-ldapUpgrade php-pecl-rrd-debugsourceUpgrade php-debugsourceUpgrade php-enchantUpgrade php-ffi-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-ldap-debuginfoUpgrade php-process-debuginfoUpgrade libzip-develUpgrade phpUpgrade php-snmp-debuginfoUpgrade php-gmp-debuginfoUpgrade php-mysqlndUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade libzip-toolsUpgrade php-debuginfoUpgrade libzipUpgrade php-jsonUpgrade php-gmpUpgrade libzip-debugsourceUpgrade php-json-debuginfoUpgrade php-pecl-zipUpgrade php-cli-debuginfoUpgrade php-odbc-debuginfoUpgrade php-processUpgrade php-pecl-xdebugUpgrade php-pdo-debuginfoUpgrade php-soapUpgrade php-gdUpgrade php-bcmathUpgrade php-fpmUpgrade php-pecl-rrd-debuginfoUpgrade php-commonUpgrade libzip-tools-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-odbcUpgrade php-pecl-rrdUpgrade php-intl-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pecl-apcu-develUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade php-develUpgrade php-pecl-apcuUpgrade php-dbaUpgrade php-pecl-xdebug-debugsourceUpgrade php-common-debuginfoUpgrade php-opcache-debuginfoUpgrade php-mbstringUpgrade php-dbg-debuginfoUpgrade php-dba-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade libzip-debuginfoUpgrade php-xml-debuginfoUpgrade php-pdoUpgrade php-pecl-xdebug-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-mbstring-debuginfo	Mar 12, 2024	Nov 19, 2020
Ubuntu	—	Upgrade drupal7 (Ubuntu Pro)Upgrade php-pear	Dec 2, 2020	Nov 19, 2020

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence