Skip to content
Fencer Intel
no cvss —

DRUPAL-CORE-2019-012 json

The Drupal project uses the third-party library [Archive\_Tar](https://pear.php.net/package/Archive_Tar/), which has released a security im…

published 6y ago modified last mo.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The Drupal project uses the third-party library [Archive\_Tar](https://pear.php.net/package/Archive_Tar/), which has released a security improvement that is needed to protect some Drupal configurations.

Multiple vulnerabilities are possible if Drupal is configured to allow `.tar`, `.tar.gz`, `.bz2` or `.tlz` file uploads and processes them.

The latest versions of Drupal update `Archive_Tar` to 1.4.9 to mitigate the file processing vulnerabilities.

*Edited to clarify the nature of the upstream release.*

Patch / fix

  • packagist drupal/core 8.7.11, 8.8.1

Is DRUPAL-CORE-2019-012 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist drupal/core
>=8.0.0, <8.7.11
>=8.8.0, <8.8.1
8.7.11
8.8.1

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.