Critical File Overwrite Vulnerability in php-pear: Archive_Tar Package
Summary
CVE-2020-28949: Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. Affects php-pear across 3 version ranges.
< 1:1.10.9+submodules+notgz-1.1
< 19bb8e95490d3e3ad92fcac95500ca80bdcc7495
>= 497914920385b7016ac9c9367e0198530787adf2, < 98b9dd73fb606159242c98a57aa9068d8fa3328d
Fixed in 1:1.10.9+submodules+notgz-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The php-pear package is a widely used PHP extension that provides a framework and distribution system for reusable PHP components. The Archive_Tar component within php-pear allows for the creation and manipulation of tar archives. However, it has been found to have a critical vulnerability that can lead to unauthorized file overwrites, posing significant security risks to applications relying on this package.
Vulnerability Detail
The vulnerability, identified as CVE-2020-28949, arises from inadequate filename sanitization in the Archive_Tar component. While it addresses phar attacks, it fails to mitigate other stream-wrapper attacks, such as file://, which can be exploited to overwrite files on the server. This oversight can lead to severe consequences, including data loss, unauthorized access, and potential system compromise. The vulnerability affects multiple versions of the php-pear package across various Debian ecosystems.
How To Fix
Minimum fixed version
1:1.10.9+submodules+notgz-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-pearTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected files and directories or implement additional input validation to prevent malicious file paths from being processed. However, upgrading the package is the recommended solution.
Conclusion
The CVE-2020-28949 vulnerability in the php-pear package's Archive_Tar component poses a significant risk due to inadequate filename sanitization. Users are strongly advised to upgrade to the latest version to mitigate potential threats and ensure the security of their applications.
See every vulnerability recorded for php-pear →
FAQ
CVE-2020-28949 is a vulnerability in the Archive_Tar component of the php-pear package that allows attackers to exploit filename sanitization issues, potentially leading to file overwrites.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized file overwrites, data loss, and potential system compromise, posing significant security risks to applications.
While upgrading is the best solution, you can implement additional input validation and restrict access to affected files as a temporary workaround.
The CVSS score of CVE-2020-28949 is 7.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for php-pear.
