Actively exploited · Published Jan 18, 2021 · Assigned by mitre
CVE-2020-36193
High 7.5 Exploited
In plain English
A high-severity security flaw in Archive_Tar from PEAR. Attackers are actively exploiting it in the wild (listed by CISA on August 25, 2022). The chance it is exploited in the next 30 days is estimated at 70.6% (higher than 99.4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)70.6%top 0.6% of all CVEs
Exploited in the wildYesCISA KEV since Aug 25, 2022
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Sep 15, 2022.
Official description
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | apcu-panel | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | libzip-tools | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | libzip-tools | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | php | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-bcmath | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-bcmath | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-cli | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-cli | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-common | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-common | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-dba | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-dba | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-dbg | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-dbg | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-devel | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-devel | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-embedded | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-embedded | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-enchant | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-enchant | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-ffi | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-ffi | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-fpm | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-fpm | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-gd | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-gd | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-gmp | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-gmp | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-intl | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-intl | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-json | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-json | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-ldap | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-ldap | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-mbstring | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-mbstring | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-mysqlnd | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-mysqlnd | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-odbc | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-odbc | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-opcache | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-opcache | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pdo | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pdo | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pear | 1:1.10.13-1.module_el8.6.0+3268+b150a051 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.18-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.18-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-rrd | 2.0.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-rrd | 2.0.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-xdebug | 2.9.5-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-xdebug | 2.9.5-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-zip | 1.18.2-1.module_el8.6.0+2750+78feabcb | ALSA-2022:6542 |
| AlmaLinux:8 | php-pecl-zip | 1.18.2-1.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pgsql | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-pgsql | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-process | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-process | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-snmp | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-snmp | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-soap | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-soap | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-xml | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-xml | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| AlmaLinux:8 | php-xmlrpc | 7.4.19-4.module_el8.6.0+3238+624bf8b8 | ALSA-2022:6542 |
| AlmaLinux:8 | php-xmlrpc | 7.4.19-4.module_el8.6.0+3239+bedf0508 | ALSA-2022:6542 |
| Alpine:v3.20 | drupal7 | 7.78-r0 | ALPINE-CVE-2020-36193 |
| Debian:12 | php-pear | 1:1.10.12+submodules+notgz+20210212-1 | DEBIAN-CVE-2020-36193 |
| Debian:13 | php-pear | 1:1.10.12+submodules+notgz+20210212-1 | DEBIAN-CVE-2020-36193 |
| Debian:14 | php-pear | 1:1.10.12+submodules+notgz+20210212-1 | DEBIAN-CVE-2020-36193 |
| Packagist | pear/archive_tar | 1.4.13 | GHSA-rpw6-9xfx-jvcx |
| Rocky Linux:8 | libzip | 0:1.6.1-1.module+el8.6.0+789+2130c178 | RLSA-2022:6542 |
| Rocky Linux:8 | libzip | 0:1.6.1-1.module+el8.4.0+415+e936cba3 | RLSA-2022:6542 |
| Rocky Linux:8 | php | 0:7.4.19-4.module+el8.6.0+1006+0d5a469f | RLSA-2022:6542 |
| Rocky Linux:8 | php-pear | 1:1.10.13-1.module+el8.7.0+1067+0a7071cc | RLSA-2022:6542 |
| Rocky Linux:8 | php-pear | 1:1.10.13-1.module+el8.6.0+1006+0d5a469f | RLSA-2022:6542 |
| Rocky Linux:8 | php-pecl-apcu | 0:5.1.18-1.module+el8.6.0+789+2130c178 | RLSA-2022:6542 |
| Rocky Linux:8 | php-pecl-apcu | 0:5.1.18-1.module+el8.4.0+415+e936cba3 | RLSA-2022:6542 |
| Rocky Linux:8 | php-pecl-rrd | 0:2.0.1-1.module+el8.4.0+414+2e7afcdd | RLSA-2022:6542 |
| Rocky Linux:8 | php-pecl-xdebug | 0:2.9.5-1.module+el8.4.0+415+e936cba3 | RLSA-2022:6542 |
| Rocky Linux:8 | php-pecl-zip | 0:1.18.2-1.module+el8.4.0+415+e936cba3 | RLSA-2022:6542 |
| Rocky Linux:8 | php-pecl-zip | 0:1.18.2-1.module+el8.6.0+789+2130c178 | RLSA-2022:6542 |
Affected products (as reported)
Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916 x_refsource_MISC
- https://www.drupal.org/sa-core-2021-001 x_refsource_CONFIRM
- [debian-lts-announce] 20210121 [SECURITY] [DLA-2530-1] drupal7 security update mailing-list, x_refsource_MLIST
- GLSA-202101-23 vendor-advisory, x_refsource_GENTOO
- FEDORA-2021-02996612f6 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-dc7de65eed vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20210408 [SECURITY] [DLA 2621-1] php-pear security update mailing-list, x_refsource_MLIST
- DSA-4894 vendor-advisory, x_refsource_DEBIAN
- FEDORA-2021-8093e197f4 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-0c013f520c vendor-advisory, x_refsource_FEDORA
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-36193 government-resource