Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
Summary
GHSA-m9fv-whq2-6wmc: Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar. Affects drupal/drupal across 3 version ranges.
>= 7.0.0, < 7.69
>= 8.0.0, < 8.7.11
>= 8.8.0, < 8.8.1
Fixed in 7.69, 8.7.11 or 8.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) used for building websites and applications. It utilizes various third-party libraries to provide additional functionality. One such library is Archive_Tar, which is responsible for handling file uploads and processing .tar, .tar.gz, .bz2, or .tlz files. However, this library has been found to have multiple vulnerabilities that can be exploited if Drupal is configured to allow these file types. These vulnerabilities can have severe consequences for Drupal installations.
Vulnerability Detail
The vulnerabilities arise from the use of the Archive_Tar library in Drupal. If an attacker uploads a malicious .tar, .tar.gz, .bz2, or .tlz file and Drupal processes it, multiple security issues can occur. These issues can lead to unauthorized access, remote code execution, and other malicious activities. The vulnerabilities have been assigned a CVSS score of 8.1, indicating a high level of severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.697.69composer require drupal/drupal:7.69 -
>= 8.0.0, < 8.7.118.7.11composer require drupal/drupal:8.7.11 -
>= 8.8.0, < 8.8.18.8.1composer require drupal/drupal:8.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for these vulnerabilities. The recommended solution is to apply the available security update.
Conclusion
Drupal core is affected by multiple vulnerabilities due to the use of the third-party library Archive_Tar. These vulnerabilities can have severe consequences, including unauthorized access and remote code execution. It is crucial for Drupal administrators to update their installations to the latest version that includes the necessary security fixes. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for drupal/drupal →
FAQ
Drupal is an open-source content management system (CMS) used for building websites and applications.
Archive_Tar is a third-party library used by Drupal for handling file uploads and processing .tar, .tar.gz, .bz2, or .tlz files.
These vulnerabilities can lead to unauthorized access, remote code execution, and other malicious activities on Drupal installations.
The vulnerabilities have been assigned a CVSS score of 8.1, indicating a high level of severity.
To fix these vulnerabilities, update Drupal to the latest version, which includes an updated version of the Archive_Tar library (1.4.9).
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/drupal.
