Lucene search

K

PRIOn knowledge basePRION:CVE-2020-28949

HistoryNov 19, 2020 - 7:15 p.m.

Code injection

2020-11-1919:15:00

PRIOn knowledge base

www.prio-n.com

12

7.6 High

AI Score

Confidence

High

0.936 High

EPSS

Percentile

99.1%

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

CPENameOperatorVersion
debian_linuxeq9.0
debian_linuxeq10.0
drupalge7.0
drupallt7.75
drupalge8.8.0
drupallt8.8.12
drupalge8.0.0
drupallt8.9.10
drupalge9.0.0
drupallt9.0.9

Rows per page:

1-10 of 151

References

packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.html

github.com/pear/Archive_Tar/issues/33

lists.debian.org/debian-lts-announce/2020/11/msg00045.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/

security.gentoo.org/glsa/202101-23

www.debian.org/security/2020/dsa-4817

www.drupal.org/sa-core-2020-013

7.6 High

AI Score

Confidence

High

0.936 High

EPSS

Percentile

99.1%