Description
In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | php-pear | 1:1.10.13+submodules+notgz-1 | — |
| Debian 13 | php-pear | 1:1.10.13+submodules+notgz-1 | — |
| Debian 12 | php-pear | 1:1.10.13+submodules+notgz-1 | — |
| Debian 9 | drupal7 | 7.52-2+deb9u16 | DLA-2721-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | php-pear | 1:1.10.12+submodules+notgz+20210212-1ubuntu1 | — |
| Ubuntu 20.04 LTS | php-pear | 1:1.10.9+submodules+notgz-1ubuntu0.20.04.3 | USN-5027-1 |
| Ubuntu 18.04 LTS | php-pear | 1:1.10.5+submodules+notgz-1ubuntu1.18.04.4 | USN-5027-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | drupal7 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | php-pear | 1:1.10.1+submodules+notgz-6ubuntu0.3+esm1 | USN-5027-2 |
| Ubuntu Pro 14.04 LTS | drupal7 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | apcu-panel +2 | 5.1.18-1.module+el8.3.0+6678+b09f589e | RHSA-2022:7628 |
| RHEL 8 | libzip +2 | 1.6.1-1.module+el8.3.0+6678+b09f589e | RHSA-2022:7628 |
| RHEL 8 | php +25 | 7.4.30-1.module+el8.7.0+15886+8e29b882 | RHSA-2022:7628 |
| RHEL 8 | php-pear | 1:1.10.13-1.module+el8.7.0+15127+a450a8db | RHSA-2022:7628 |
| RHEL 8 | php-pecl-rrd | 2.0.1-1.module+el8.3.0+6678+b09f589e | RHSA-2022:7628 |
| RHEL 8 | php-pecl-xdebug | 2.9.5-1.module+el8.3.0+6678+b09f589e | RHSA-2022:7628 |
| RHEL 8 | php-pecl-zip | 1.18.2-1.module+el8.3.0+6678+b09f589e | RHSA-2022:7628 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | apcu-panel +2 | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux 8 | libzip +2 | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux 8 | php +25 | 7.4.30-1.module_el8.7.0+3286+227f3cf0 | ALSA-2022:7628 |
| AlmaLinux 8 | php-pear | 1:1.10.13-1.module_el8.6.0+3268+b150a051 | ALSA-2022:7628 |
| AlmaLinux 8 | php-pecl-rrd | 2.0.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux 8 | php-pecl-xdebug | 2.9.5-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
| AlmaLinux 8 | php-pecl-zip | 1.18.2-1.module_el8.6.0+2750+78feabcb | ALSA-2022:7628 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libzip | 1.6.1-1.module+el8.4.0+415+e936cba3 | RLSA-2022:7628 |
| Rocky Linux 8 | php | 7.4.30-1.module+el8.7.0+1067+0a7071cc | RLSA-2022:7628 |
| Rocky Linux 8 | php-pear | 1:1.10.13-1.module+el8.6.0+1006+0d5a469f | RLSA-2022:7628 |
| Rocky Linux 8 | php-pecl-apcu | 5.1.18-1.module+el8.4.0+415+e936cba3 | RLSA-2022:7628 |
| Rocky Linux 8 | php-pecl-rrd | 2.0.1-1.module+el8.4.0+414+2e7afcdd | RLSA-2022:7628 |
| Rocky Linux 8 | php-pecl-xdebug | 2.9.5-1.module+el8.4.0+415+e936cba3 | RLSA-2022:7628 |
| Rocky Linux 8 | php-pecl-zip | 1.18.2-1.module+el8.4.0+415+e936cba3 | RLSA-2022:7628 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | php8-pear | 1.10.21-150400.9.3.1 | SUSE-SU-2022:3198-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | php8-pear | 1.10.21-150400.9.3.1 | SUSE-SU-2022:3198-2 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.20 | drupal7 | 7.82-r0 | — |
| Alpine v3.19 | drupal7 | 7.82-r0 | — |
| Alpine v3.18 | drupal7 | 7.82-r0 | — |
| Alpine v3.17 | drupal7 | 7.82-r0 | — |
| Alpine v3.16 | drupal7 | 7.82-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.15 | drupal7 | 7.82-r0 | — |
| Alpine v3.14 | drupal7 | 7.82-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | php-pear | 1:1.10.12-9.amzn2 | ALAS2-2021-1708 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | apcu-panel +2 | 5.1.18-1.module+el8.3.0+7685+72d70b58 | ELSA-2022-7628 |
| Oracle Linux 8 | libzip +2 | 1.6.1-1.module+el8.3.0+7685+72d70b58 | ELSA-2022-7628 |
| Oracle Linux 8 | php +25 | 7.4.30-1.module+el8.7.0+20800+8e29b882 | ELSA-2022-7628 |
| Oracle Linux 8 | php-pear | 1:1.10.13-1.module+el8.7.0+20800+8e29b882 | ELSA-2022-7628 |
| Oracle Linux 8 | php-pecl-rrd | 2.0.1-1.module+el8.3.0+7685+72d70b58 | ELSA-2022-7628 |
| Oracle Linux 8 | php-pecl-xdebug | 2.9.5-1.module+el8.3.0+7685+72d70b58 | ELSA-2022-7628 |
| Oracle Linux 8 | php-pecl-zip | 1.18.2-1.module+el8.3.0+7685+72d70b58 | ELSA-2022-7628 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.0.0, < 8.9.17 · >= 9.1.0, < 9.1.11 · >= 9.2.0, < 9.2.2 | 8.9.17, 9.1.11, 9.2.2 | DRUPAL-CORE-2021-004 |
| Packagist | pear/archive_tar | < 1.4.14 | 1.4.14 | GHSA-p8q8-jfcv-g2h2 |
Advisories 10
- ALSA-2022:7628 Moderate: php:7.4 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:7628 Red Hat Security Advisory: php:7.4 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- USN-5027-2 php-pear vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5027-1 php-pear vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-2721-1 drupal7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:7628 Moderate: php:7.4 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2022:3198-1 Security update for php8-pear SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3198-2 Security update for php8-pear SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2022-7628 Moderate: php:7.4 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 15, 2022
- ALAS2-2021-1708 Moderate: php-pear security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 15, 2021
References
- https://www.drupal.org/sa-core-2021-004
- [debian-lts-announce] 20210726 [SECURITY] [DLA 2721-1] drupal7 security update mailing-list
- https://github.com/pear/Archive_Tar/releases/tag/1.4.14
- https://github.com/pear/Archive_Tar/commit/b5832439b1f37331fb4f87e67fe4f
- FEDORA-2021-6cf271948a vendor-advisory
- FEDORA-2021-c9c1f6e5c7 vendor-advisory
- https://github.com/pear/Archive_Tar/commit/7789ebb2f34f9e4adb3a4152ad0d1548930a9755
- FEDORA-2021-8093e197f4 vendor-advisory
- FEDORA-2021-0c013f520c vendor-advisory