| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/core | ≥ 8.0.0, < 8.8.12≥ 8.9.0, < 8.9.10≥ 9.0.0, < 9.0.9 | 8.8.128.9.109.0.9 |
| pear/archive_tar | < 1.4.11 | 1.4.11 |
| drupal | ≥ 7.0, < 7.75≥ 8.0.0, < 8.9.10≥ 8.8.0, < 8.8.12≥ 9.0.0, < 9.0.9 | 7.758.9.108.8.129.0.9 |
| archive tar | < 1.4.11 | 1.4.11 |
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. See: https://github.com/pear/Archive_Tar/issues/33
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free