DemoBook a demo

Vulnerability advisory

CVE-2020-28948

Published Updated OSV record ↗

Also known as BIT-drupal-2020-28948BIT-drupal-2020-28949CVE-2020-28949DRUPAL-CORE-2020-013GHSA-75c5-f4gw-38r9GHSA-jh5x-hfhg-78jq

Severity
  • CVSS 3.xCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 to before 98b9dd73fb606159242c98a57aa9068d8fa3328d98b9dd73fb606159242c98a57aa9068d8fa3328d
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before f7a296a30a0bce9062fd655388fefe30d832e003f7a296a30a0bce9062fd655388fefe30d832e003
f2b59e3ae8097ea01d15c708f1267b73794399c0 to before 58153924a828197866f99804f3e5b9ee9a4cc60058153924a828197866f99804f3e5b9ee9a4cc600
d62812dc17ce593beb2ccd4cdbee1a76c95e3fd7 to before 14803c18e98871592f360f9406cd7ece99aaa9bf14803c18e98871592f360f9406cd7ece99aaa9bf
Also listed as affected (59)
  • 8.9.9
  • 9.0.8
  • 7.74
  • 7.73
  • 8.9.8
  • 9.0.7
  • 8.8.9
  • 8.9.5
  • 9.0.5
  • 7.72
  • 8.9.4
  • 8.9.3
  • 9.0.3
  • 8.9.2
  • 9.0.2
  • 7.71
  • 8.8.7
  • 8.9.0
  • 9.0.0
  • 8.9.0-rc1
  • 8.8.5
  • 8.9.0-beta3
  • 8.9.0-beta2
  • 8.9.0-beta1
  • 8.8.3
  • 8.8.2
  • 8.8.0
  • 7.68
  • 7.64
  • 7.61
  • 7.56
  • 7.55
  • 7.54
  • 7.51
  • 7.50
  • 7.43
  • 8.1.0-beta1
  • 7.42
  • 8.0.0
  • 7.40
  • 7.37
  • 7.36
  • 7.33
  • 7.30
  • 7.28
  • 7.25
  • 7.23
  • 7.22
  • 7.17
  • 7.15
  • 7.14
  • 7.12
  • 7.10
  • 7.9
  • 7.8
  • 7.7
  • 7.6
  • 7.4
  • 7.0
GIT github.com/pear/archive_tar ↗
All commits before 17d355cb7d3c4ff08e5729f29cd7660145208d9d17d355cb7d3c4ff08e5729f29cd7660145208d9d
Also listed as affected (14)
  • 1.4.10
  • 1.4.9
  • 1.4.8
  • 1.4.7
  • 1.4.6
  • 1.4.5
  • 1.4.4
  • 1.4.2
  • 1.4.3
  • 1.4.1
  • 1.4.0
  • 1.3.13
  • 1.3.12
  • 1.3.11

Description

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.