PT-2020-6225 · Php+6 · Archive Tar+6

Luke Stewart · Published 2020-11-17 · Updated 2025-11-07 · CVE-2020-28948

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Archive Tar versions 1.4.10 and earlier

Description The issue allows an unserialization attack because phar: is blocked but PHAR: is not blocked. This can be exploited by a remote attacker to execute arbitrary PHP code using a specially crafted .tar archive. The vulnerability is related to the restoration of an untrusted data structure in memory.

Recommendations For Archive Tar versions 1.4.10 and earlier, consider disabling the use of PHAR: until a patch is available. As a temporary workaround, restrict the use of the Archive Tar class to minimize the risk of exploitation. Avoid using specially crafted .tar archives that could trigger the unserialization attack.

Exploit

Fix

Special Elements Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-74

CWE-502

Related Identifiers

ALSA-2022:6542

ALSA-2022_6542

BDU:2021-03621

BIT-DRUPAL-2020-28948

BIT-DRUPAL-2020-28949

CESA-2022_6542

CVE-2020-28948

DLA-2465-1

DLA-2466-1

DLA-2621-1

DRUPAL-CORE-2020-013

DSA-4817-1

ELSA-2022-6542

ELSA-2022-7340

GHSA-75C5-F4GW-38R9

GHSA-JH5X-HFHG-78JQ

MGASA-2020-0453

RHSA-2022:6541

RHSA-2022:6542

RHSA-2022:7340

RHSA-2022_6542

RHSA-2022_7340

RLSA-2022:6542

RLSA-2022_6542

USN-4654-1

USN-6981-1

USN-6981-2

Affected Products

Almalinux

Archive Tar

Centos

Linuxmint

Red Hat

Rocky Linux

Ubuntu

References · 88

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/pear/archive_tar/CVE-2020-28949.yaml · Exploit
• 🔥 https://github.com/pear/Archive_Tar/issues/33 · Exploit
• 🔥 https://github.com/0x240x23elu/CVE-2020-28948-and-CVE-2020-28949 · Exploit
• https://osv.dev/vulnerability/DSA-4817-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2466-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0453.html · Security Note
• https://osv.dev/vulnerability/ALSA-2022:6542 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28949 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28948 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:6542 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28948 · Security Note
• https://osv.dev/vulnerability/GHSA-jh5x-hfhg-78jq · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N · Vendor Advisory