Vulnerability advisory

CVE-2019-6338

Published Jan 22, 2019Updated Oct 24, 2026OSV record ↗

Also known as DRUPAL-CORE-2019-001GHSA-6rmq-x2hv-vxpp

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 to before 492fd4da5c9e8c0695f779f1967e7f90960d343b	`492fd4da5c9e8c0695f779f1967e7f90960d343b`
b73ab73d39dca97a12513e8a9e4f4da4b0676f5f to before 3c5a5276ab17f2e117ecaae6ecda16f918e5fb7d	`3c5a5276ab17f2e117ecaae6ecda16f918e5fb7d`
9b04d294324d9c76be4b596de4316cb8804e8223 to before c9f66f9f581cd0734fe74c1cbb1addce3260cf5d	`c9f66f9f581cd0734fe74c1cbb1addce3260cf5d`
Also listed as affected (38) `7.61` `8.5.8` `8.6.5` `8.6.4` `8.6.3` `8.6.1` `8.5.7` `8.6.0` `8.5.5` `8.5.4` `8.5.0` `7.56` `7.55` `7.54` `7.51` `7.50` `7.43` `7.42` `7.40` `7.37` `7.36` `7.33` `7.30` `7.28` `7.25` `7.23` `7.22` `7.17` `7.15` `7.14` `7.12` `7.10` `7.9` `7.8` `7.7` `7.6` `7.4` `7.0`

Description

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details

CVE-2019-6338

Affected versions

Repository

Description

References