Vulnerability advisory

GHSA-6rmq-x2hv-vxpp

Drupal core third-party PEAR Archive_Tar library is vulnerable to Deserialization of Untrusted Data

Published Dec 2, 2019Updated Dec 10, 2025OSV record ↗

Also known as CVE-2019-6338DRUPAL-CORE-2019-001

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected versions

drupal/drupal Packagist

All drupal/drupal advisories →

Affected	Fixed in
`7.0.0` to before 7.62.0	`7.62.0`Advisories →
`8.0.0` to before 8.5.9	`8.5.9`Advisories →
Also listed as affected (74) `8.0.0` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6` `8.2.7` `8.2.8` `8.3.0` `8.3.0-alpha1` `8.3.0-beta1` `8.3.0-rc1` `8.3.0-rc2` `8.3.1` `8.3.2` `8.3.3` `8.3.4` `8.3.5` `8.3.6` `8.3.7` `8.3.8` `8.3.9` `8.4.0` `8.4.0-alpha1` `8.4.0-beta1` `8.4.0-rc1` `8.4.0-rc2` `8.4.1` `8.4.2` `8.4.3` `8.4.4` `8.4.5` `8.4.6` `8.4.7` `8.4.8` `8.5.0` `8.5.0-alpha1` `8.5.0-beta1` `8.5.0-rc1` `8.5.1` `8.5.2` `8.5.3` `8.5.4` `8.5.5` `8.5.6` `8.5.7` `8.5.8`
`8.6.0` to before 8.6.6	`8.6.6`Advisories →
Also listed as affected (6) `8.6.0` `8.6.1` `8.6.2` `8.6.3` `8.6.4` `8.6.5`

Description

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details

GHSA-6rmq-x2hv-vxpp

Affected versions

drupal/drupal Packagist

Description

References