DemoBook a demo

Vulnerability advisory

CVE-2020-28949

Published Updated OSV record ↗

Also known as BIT-drupal-2020-28948BIT-drupal-2020-28949CVE-2020-28948DRUPAL-CORE-2020-013GHSA-75c5-f4gw-38r9GHSA-jh5x-hfhg-78jq

Severity
  • CVSS 3.xCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 to before 98b9dd73fb606159242c98a57aa9068d8fa3328d98b9dd73fb606159242c98a57aa9068d8fa3328d
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before f7a296a30a0bce9062fd655388fefe30d832e003f7a296a30a0bce9062fd655388fefe30d832e003
f2b59e3ae8097ea01d15c708f1267b73794399c0 to before 58153924a828197866f99804f3e5b9ee9a4cc60058153924a828197866f99804f3e5b9ee9a4cc600
d62812dc17ce593beb2ccd4cdbee1a76c95e3fd7 to before 14803c18e98871592f360f9406cd7ece99aaa9bf14803c18e98871592f360f9406cd7ece99aaa9bf
Also listed as affected (59)
  • 8.9.9
  • 9.0.8
  • 7.74
  • 7.73
  • 8.9.8
  • 9.0.7
  • 8.8.9
  • 8.9.5
  • 9.0.5
  • 7.72
  • 8.9.4
  • 8.9.3
  • 9.0.3
  • 8.9.2
  • 9.0.2
  • 7.71
  • 8.8.7
  • 8.9.0
  • 9.0.0
  • 8.9.0-rc1
  • 8.8.5
  • 8.9.0-beta3
  • 8.9.0-beta2
  • 8.9.0-beta1
  • 8.8.3
  • 8.8.2
  • 8.8.0
  • 7.68
  • 7.64
  • 7.61
  • 7.56
  • 7.55
  • 7.54
  • 7.51
  • 7.50
  • 7.43
  • 8.1.0-beta1
  • 7.42
  • 8.0.0
  • 7.40
  • 7.37
  • 7.36
  • 7.33
  • 7.30
  • 7.28
  • 7.25
  • 7.23
  • 7.22
  • 7.17
  • 7.15
  • 7.14
  • 7.12
  • 7.10
  • 7.9
  • 7.8
  • 7.7
  • 7.6
  • 7.4
  • 7.0
GIT github.com/pear/archive_tar ↗
All commits before 19bb8e95490d3e3ad92fcac95500ca80bdcc749519bb8e95490d3e3ad92fcac95500ca80bdcc7495
Also listed as affected (15)
  • 1.4.11
  • 1.4.10
  • 1.4.9
  • 1.4.8
  • 1.4.7
  • 1.4.6
  • 1.4.5
  • 1.4.4
  • 1.4.2
  • 1.4.3
  • 1.4.1
  • 1.4.0
  • 1.3.13
  • 1.3.12
  • 1.3.11

Description

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.