Actively exploited · Published Nov 19, 2020 · Assigned by mitre
CVE-2020-28949
High 7.8 Exploited
In plain English
A high-severity security flaw in Archive_Tar from PEAR. Attackers are actively exploiting it in the wild (listed by CISA on August 25, 2022). The chance it is exploited in the next 30 days is estimated at 84.6% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)84.6%top 0.3% of all CVEs
Exploited in the wildYesCISA KEV since Aug 25, 2022
Attack tooling2Metasploit, Public PoC
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Sep 15, 2022.
Official description
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | apcu-panel | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | libzip-tools | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | libzip-tools | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | php | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-bcmath | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-bcmath | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-cli | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-cli | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-common | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-common | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-dba | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-dba | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-dbg | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-dbg | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-devel | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-devel | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-embedded | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-embedded | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-enchant | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-enchant | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-ffi | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-ffi | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-fpm | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-fpm | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-gd | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-gd | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-gmp | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-gmp | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-intl | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-intl | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-json | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-json | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-ldap | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-ldap | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-mbstring | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-mbstring | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-mysqlnd | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-mysqlnd | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-odbc | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-odbc | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-opcache | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-opcache | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pdo | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pdo | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pear | 1:1.10.13-1.module_el8.6.0+3268+b150a051 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.18-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.18-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-rrd | 2.0.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-rrd | 2.0.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-xdebug | 2.9.5-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-xdebug | 2.9.5-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-zip | 1.18.2-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-zip | 1.18.2-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pgsql | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pgsql | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-process | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-process | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-snmp | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-snmp | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-soap | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-soap | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-xml | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-xml | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-xmlrpc | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-xmlrpc | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| Alpine:v3.20 | drupal7 | 7.75-r0 | ALPINE-CVE-2020-28949 |
| Debian:12 | php-pear | 1:1.10.9+submodules+notgz-1.1 | DEBIAN-CVE-2020-28949 |
| Debian:13 | php-pear | 1:1.10.9+submodules+notgz-1.1 | DEBIAN-CVE-2020-28949 |
| Debian:14 | php-pear | 1:1.10.9+submodules+notgz-1.1 | DEBIAN-CVE-2020-28949 |
| Packagist | drupal/core | 8.8.12, 8.9.10, 9.0.9 | DRUPAL-CORE-2020-013 |
| Packagist | pear/archive_tar | 1.4.11 | GHSA-jh5x-hfhg-78jq |
| Packagist | pear/archive_tar | 1.4.11 | GHSA-75c5-f4gw-38r9 |
| Rocky Linux:8 | libzip | 0:1.6.1-1.module+el8.6.0+789+2130c178 | RLSA-2022:6542 |
| Rocky Linux:8 | libzip | 0:1.6.1-1.module+el8.4.0+415+e936cba3 | RLSA-2022:6542 |
| Rocky Linux:8 | php | 0:7.4.19-4.module+el8.6.0+1006+0d5a469f | RLSA-2022:6542 |
| Rocky Linux:8 | php-pear | 1:1.10.13-1.module+el8.7.0+1067+0a7071cc | RLSA-2022:6542 |
| Rocky Linux:8 | php-pear | 1:1.10.13-1.module+el8.6.0+1006+0d5a469f | RLSA-2022:6542 |
| Rocky Linux:8 | php-pecl-apcu | 0:5.1.18-1.module+el8.4.0+415+e936cba3 | RLSA-2022:6542 |
| Rocky Linux:8 | php-pecl-apcu | 0:5.1.18-1.module+el8.6.0+789+2130c178 | RLSA-2022:6542 |
| Rocky Linux:8 | php-pecl-rrd | 0:2.0.1-1.module+el8.4.0+414+2e7afcdd | RLSA-2022:6542 |
| Rocky Linux:8 | php-pecl-xdebug | 0:2.9.5-1.module+el8.4.0+415+e936cba3 | RLSA-2022:6542 |
| Rocky Linux:8 | php-pecl-zip | 0:1.18.2-1.module+el8.4.0+415+e936cba3 | RLSA-2022:6542 |
| Rocky Linux:8 | php-pecl-zip | 0:1.18.2-1.module+el8.6.0+789+2130c178 | RLSA-2022:6542 |
Affected products (as reported)
References
- https://github.com/pear/Archive_Tar/issues/33 x_refsource_MISC
- https://www.drupal.org/sa-core-2020-013 x_refsource_CONFIRM
- [debian-lts-announce] 20201127 [SECURITY] [DLA 2466-1] drupal7 security update mailing-list, x_refsource_MLIST
- FEDORA-2020-f351eb14e3 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-5271a896ff vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-6f1079934c vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-d50d74d6f2 vendor-advisory, x_refsource_FEDORA
- DSA-4817 vendor-advisory, x_refsource_DEBIAN
- http://packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.html x_refsource_MISC
- GLSA-202101-23 vendor-advisory, x_refsource_GENTOO
- FEDORA-2021-8093e197f4 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-0c013f520c vendor-advisory, x_refsource_FEDORA
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-28949 government-resource