Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-28949: Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. 1910323: CVE-2020-28949 Archive_Tar: improper filename sanitization leads to file overwrites CVE-2020-28948: Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. 1904001: CVE-2020-28948 Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | php-pear | 1:1.10.12-4.amzn2.0.1 |
Vulnerabilities 2
-
High 7.8
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrappe…
KEV Aug 25, 2022 -
High 7.8
Multiple vulnerabilities through filename manipulation in Archive_Tar
Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.