DemoBook a demo

Vulnerability advisory

CVE-2020-36193

Published Updated OSV record ↗

Also known as BIT-drupal-2020-36193GHSA-rpw6-9xfx-jvcx

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 to before 8c555d9b7d3a202cee756104b48e580ae41a63798c555d9b7d3a202cee756104b48e580ae41a6379
a412ca41cfc0d954fe3cb2dd982dc6ca049b1c70 to before d890ca84f788f71f0066f1d06d93188f09bd3d6cd890ca84f788f71f0066f1d06d93188f09bd3d6c
d62812dc17ce593beb2ccd4cdbee1a76c95e3fd7 to before e2c554ef842f5dc683d690f0a72a8f88569f8341e2c554ef842f5dc683d690f0a72a8f88569f8341
5c6f14f762c9aef87cd2731818386f202ee8463c to before 87ab5d42451bcc6850a46c2f87a80c69bee68fe187ab5d42451bcc6850a46c2f87a80c69bee68fe1
Also listed as affected (49)
  • 7.77
  • 8.9.12
  • 9.0.10
  • 9.1.2
  • 9.1.1
  • 8.9.11
  • 9.1.0
  • 7.76
  • 8.9.8
  • 8.9.5
  • 9.0.5
  • 8.9.4
  • 8.9.3
  • 9.0.3
  • 8.9.2
  • 9.0.2
  • 7.71
  • 8.9.0
  • 9.0.0
  • 7.68
  • 7.64
  • 7.61
  • 7.56
  • 7.55
  • 7.54
  • 7.51
  • 7.50
  • 7.43
  • 7.42
  • 7.40
  • 7.37
  • 7.36
  • 7.33
  • 7.30
  • 7.28
  • 7.25
  • 7.23
  • 7.22
  • 7.17
  • 7.15
  • 7.14
  • 7.12
  • 7.10
  • 7.9
  • 7.8
  • 7.7
  • 7.6
  • 7.4
  • 7.0
GIT github.com/pear/archive_tar ↗
All commits through 17d355cb7d3c4ff08e5729f29cd7660145208d9dNo fix listed
Not specifiedcde460582ff389404b5b3ccb59374e9b389de916
Also listed as affected (15)
  • 1.4.11
  • 1.4.10
  • 1.4.9
  • 1.4.8
  • 1.4.7
  • 1.4.6
  • 1.4.5
  • 1.4.4
  • 1.4.2
  • 1.4.3
  • 1.4.1
  • 1.4.0
  • 1.3.13
  • 1.3.12
  • 1.3.11

Description

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.