PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/08/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| drupal | ≥ 7.0, < 7.75≥ 8.0.0, < 8.9.10≥ 8.8.0, < 8.8.12≥ 9.0.0, < 9.0.9 | 7.758.9.108.8.129.0.9 |
| archive tar | < 1.4.12 | 1.4.12 |
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free