CVE-2020-36193 PEAR Archive_Tar Improper Link Resolution
Attackers can exploit inadequate symbolic link checks in the Archive_Tar library to perform directory traversal and write files to arbitrary locations.
- Exploited in the wild
- Since 25 Aug 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36193?
CVE-2020-36193 is a high-severity path traversal vulnerability in Debian Debian Linux, published on 18 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
Which versions are affected by CVE-2020-36193?
3 open source packages ship an affected version, including pear/archive_tar and drupal. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
pear/archive_tar Packagist | All versions | 1.4.13 |
pear/archive_tar Packagist | All versions | 1.4.13 |
drupal Bitnami | From 7.0.0 | 7.78.0, 8.9.13, 9.0.11, 9.1.3 |
Linux distribution packages (8)
php72 SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 7.2.5-1.69.1 |
php74-pear SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 1.10.21-1.6.1 |
php7-pear SUSE:Linux Enterprise Module for Web and Scripting 15 SP2 | All versions | 1.10.21-3.6.1 |
php7-pear SUSE:Linux Enterprise Module for Web and Scripting 15 SP3 | All versions | 1.10.21-3.6.1 |
php72 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 7.2.5-1.69.1 |
php7-pear openSUSE:Leap 15.2 | All versions | 1.10.21-lp152.2.6.1 |
php7 openSUSE:Leap 15.3 | All versions | 7.2.5-4.82.1 |
php7-pear openSUSE:Leap 15.3 | All versions | 1.10.21-3.6.1 |
Products include Debian Debian Linux, Drupal Drupal, Fedoraproject Fedora, Php Archive Tar.
How do I fix CVE-2020-36193?
Upgrade pear/archive_tar to 1.4.13 or later. US federal agencies must fix it by 15 Sep 2022.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-36193 being exploited?
Yes. Attackers have exploited CVE-2020-36193 in the wild since at least 25 Aug 2022.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-drupal-2020-36193, CLEANSTART-2024-DI03393, DEBIAN-CVE-2020-36193, DLA-2530-1, DLA-2621-1, DSA-4894-1 and 10 more.