CVE-2020-28949: PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
Summary: CVE-2020-28949 is a deserialization vulnerability in PEAR Archive_Tar, where the phar: wrapper is blocked but the uppercase PHAR: is not, allowing an unserialization attack. PEAR is an open-source framework for reusable PHP components used in third-party products including Drupal Core and Red Hat Linux, and CISA set a remediation due date of 2022-09-15.
Key Takeaway: The flaw sits in a shared PHP library that reaches into Drupal Core and Red Hat Linux, so a single unpatched dependency can expose products well beyond the component itself; CISA's remediation deadline passed on 2022-09-15, and known ransomware campaign use is listed as unknown.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-28949PEAR
- Related
- CVE-2020-36193: PEAR Archive_Tar Improper Link Resolution Vulnerability Known Exploited Vulnerabilities · Aug 25, 2022Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026