Description
The Drupal project uses the third-party library [Archive\_Tar](https://pear.php.net/package/Archive_Tar/), which has released a security improvement that is needed to protect some Drupal configurations.
Multiple vulnerabilities are possible if Drupal is configured to allow `.tar`, `.tar.gz`, `.bz2` or `.tlz` file uploads and processes them.
The latest versions of Drupal update `Archive_Tar` to 1.4.9 to mitigate the file processing vulnerabilities.
*Edited to clarify the nature of the upstream release.*
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.0.0, < 8.7.11 · >= 8.8.0, < 8.8.1 | 8.7.11, 8.8.1 | DRUPAL-CORE-2019-012 |