PT-2021-4597 · Unknown+8 · Archive Tar+8

Jonathan Danaher + 3 · Published 2021-01-18 · Updated 2025-11-07 · CVE-2020-36193

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Archive Tar versions 1.4.11 and earlier

Description The vulnerability in the Archive Tar library's Tar.php file is related to improper link resolution, allowing an attacker to impact data integrity through directory traversal due to inadequate checking of symbolic links.

Recommendations For Archive Tar versions 1.4.11 and earlier, update to version 1.4.13 to resolve the issue. As a temporary workaround, consider restricting write operations to prevent directory traversal until the update is applied.

Exploit

Fix

Link Following

Path traversal

Weakness Enumeration

CWE-59

CWE-22

Related Identifiers

ALSA-2022:6542

BDU:2021-05279

BIT-DRUPAL-2020-36193

CESA-2022_6542

CVE-2020-36193

DLA-2530-1

DLA-2621-1

DSA-4894-1

GHSA-RPW6-9XFX-JVCX

MGASA-2021-0060

OPENSUSE-SU-2021:1267-1

OPENSUSE-SU-2021:2872-1

OPENSUSE-SU-2021:3018-1

OPENSUSE-SU-2021_1267-1

OPENSUSE-SU-2021_2872-1

OPENSUSE-SU-2021_3018-1

RHSA-2022:6541

RHSA-2022:6542

RHSA-2022:7340

RHSA-2022_6542

RHSA-2022_7340

RLSA-2022:6542

SUSE-SU-2021:2926-1

SUSE-SU-2021:3006-1

SUSE-SU-2021:3018-1

SUSE-SU-2021_2926-1

SUSE-SU-2021_3006-1

SUSE-SU-2021_3018-1

USN-4723-1

Affected Products

Almalinux

Archive Tar

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 92

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/fileformat/archive_tar_arb_file_write.rb · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/pear/archive_tar/CVE-2020-28949.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/pear/archive_tar/CVE-2020-36193.yaml · Exploit
• 🔥 https://github.com/0x240x23elu/CVE-2020-28948-and-CVE-2020-28949 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36193 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:6542 · Vendor Advisory
• https://access.redhat.com/security/cve/cve-2020-36193 · Security Note
• https://debian.org/security/2021/dsa-4894 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:6542 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0060.html · Security Note
• https://linux.oracle.com/errata/ELSA-2022-6542.html · Vendor Advisory
• https://security.gentoo.org/glsa/202101-23 · Vendor Advisory