正文

Pear Archive_Tar 后置链接漏洞

admin
admin V管理员 /0 评论 /14 阅读
0305
此篇文章发布距今已超过1221天，您需要注意文章的内容或图片是否可用！

漏洞信息详情

Pear Archive_Tar 后置链接漏洞

  • CNNVD编号：CNNVD-202101-1311
    • <!--
  • 危害等级： 高危-->
  • 危害等级： 高危
  • CVE编号： CVE-2020-36193
  • 漏洞类型： 后置链接
  • 发布时间： 2021-01-18
  • 威胁类型： 远程
  • 更新时间： 2021-09-26
  • 厂        商：
  • 漏洞来源： Gentoo

漏洞简介

Pear Archive_Tar是Pear（PEAR）团队的一个基于Php的可以对tar包进行创建、提取等操作的软件。

Archive_Tar through 1.4.11 存在后置链接漏洞，该漏洞允许通过目录遍历进行写操作。

漏洞公告

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916

参考网址

来源:MISC

链接:https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916

来源:GENTOO

链接:https://security.gentoo.org/glsa/202101-23

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/YKD5WEFA4WT6AVTMRAYBNXZNLWZHM7FH/

来源:DEBIAN

链接:https://www.debian.org/security/2021/dsa-4894

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/

来源:CONFIRM

链接:https://www.drupal.org/sa-core-2021-001

来源:MLIST

链接:https://lists.debian.org/debian-lts-announce/2021/01/msg00018.html

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/

来源:MLIST

链接:https://lists.debian.org/debian-lts-announce/2021/04/msg00007.html

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/FOZNK4FIIV7FSFCJNNFWMJZTTV7NFJV2/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.1195

来源:vigilance.fr

链接:https://vigilance.fr/vulnerability/Archive-Tar-directory-traversal-via-Tar-php-34382

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.2973

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2020-36193

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.1343

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.3059

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/161111/Gentoo-Linux-Security-Advisory-202101-23.html

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/161317/Ubuntu-Security-Notice-USN-4723-1.html

来源:www.cybersecurity-help.cz

链接:https://www.cybersecurity-help.cz/vdb/SB2021042122

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0428

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0239/

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-impacted-by-a-directory-traversal-vulnerability-in-drupal-core-sa-core-2021-001-cve-2020-36193/

受影响实体

    暂无


补丁

    暂无