Vulnerability advisory

DRUPAL-CORE-2019-001

Published Jan 16, 2019Updated Sep 19, 2026OSV record ↗

Also known as CVE-2019-6338GHSA-6rmq-x2hv-vxpp

Severity

Severity not reported.

Affected versions

drupal/core Packagist

Affected	Fixed in
`8.0.0` to before 8.5.9	`8.5.9`Advisories →
`8.6.0` to before 8.6.6	`8.6.6`Advisories →
Also listed as affected (80) `8.0.0` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6` `8.2.7` `8.2.8` `8.3.0` `8.3.0-alpha1` `8.3.0-beta1` `8.3.0-rc1` `8.3.0-rc2` `8.3.1` `8.3.2` `8.3.3` `8.3.4` `8.3.5` `8.3.6` `8.3.7` `8.3.8` `8.3.9` `8.4.0` `8.4.0-alpha1` `8.4.0-beta1` `8.4.0-rc1` `8.4.0-rc2` `8.4.1` `8.4.2` `8.4.3` `8.4.4` `8.4.5` `8.4.6` `8.4.7` `8.4.8` `8.5.0` `8.5.0-alpha1` `8.5.0-beta1` `8.5.0-rc1` `8.5.1` `8.5.2` `8.5.3` `8.5.4` `8.5.5` `8.5.6` `8.5.7` `8.5.8` `8.6.0` `8.6.1` `8.6.2` `8.6.3` `8.6.4` `8.6.5`

Description

Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details.

References

Webwww.drupal.org/sa-core-2019-001 ↗