CVE-2021-32610

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.30), php-pear (1.10.13). (BZ#2055422)

Security Fix(es):

• php: Special character breaks path in xml parsing (CVE-2021-21707)

• php: Use after free due to php_filter_float() failing for ints (CVE-2021-21708)

• php-pear: Directory traversal vulnerability (CVE-2021-32610)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.30), php-pear (1.10.13). (BZ#2055422)

Security Fix(es):

• php: Special character breaks path in xml parsing (CVE-2021-21707)
• php: Use after free due to php_filter_float() failing for ints (CVE-2021-21708)
• php-pear: Directory traversal vulnerability (CVE-2021-32610)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The Drupal project uses the pear Archive_Tar library, which has released a security update that impacts Drupal.

The vulnerability is mitigated by the fact that Drupal core's use of the Archive_Tar library is not vulnerable, as it does not permit symlinks.

Exploitation may be possible if contrib or custom code uses the library to extract tar archives (for example .tar, .tar.gz, .bz2, or .tlz) which come from a potentially untrusted source.

This advisory is not covered by Drupal Steward.

Updated php-pear packages fix security vulnerability:

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive (CVE-2021-32610).

These are all security issues fixed in the php7-pear-1.10.21-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the php8-pear-1.10.21-1.2 package on the GA media of openSUSE Tumbleweed.

This update for php8-pear fixes the following issues:

• Add php8-pear to SLE15-SP4 (jsc#SLE-24728)

• Update to 1.10.21

  • PEAR 1.10.13
    • unsupported protocol - use --force to continue
    • Add $this operator to _determineIfPowerpc calls

• Update to 1.10.20

  • Archive_Tar 1.4.14
    • Properly fix symbolic link path traversal (CVE-2021-32610)
  • Archive_Tar 1.4.13
    • Relative symlinks failing (out-of path file extraction)
  • Archive_Tar 1.4.12
  • Archive_Tar 1.4.11
  • Archive_Tar 1.4.10
    • Fix block padding when the file buffer length is a multiple of 512 and smaller than Archive_Tar buffer length
    • Don't try to copy username/groupname in chroot jail

• provides and obsoletes php7-pear-Archive_Tar, former location of PEAR/Archive/Tar.php

• Update to version 1.10.19

  • PEAR 1.10.12
    • adjust dependencies based on new releases
  • XML_Util 1.4.5
    • fix Trying to access array offset on value of type int

• Update to version 1.10.18

• Remove pear-cacheid-array-check.patch (upstreamed)

• Contents of .filemap are now sorted internally

• Sort contents of .filemap to make build reproducible

• Recommend php7-openssl to allow https sources to be used

• Modify metadata_dir for system configuration only

• Add /var/lib/pear directory where xml files are stored

• Cleanup %files section

• Only use the GPG keys of Chuck Burgess. Extracted from the Release Manager public keys.

• Add release versions of PEAR modules

• Install metadata files (registry, filemap, channels, ...) in /var/lib/pear/ instead of /usr/share/php7/PEAR/

• Update to version 1.10.17

This update for php8-pear fixes the following issues:

• Add php8-pear to SLE15-SP4 (jsc#SLE-24728)

• Update to 1.10.21

  • PEAR 1.10.13
    • unsupported protocol - use --force to continue
    • Add $this operator to _determineIfPowerpc calls

• Update to 1.10.20

  • Archive_Tar 1.4.14
    • Properly fix symbolic link path traversal (CVE-2021-32610)
  • Archive_Tar 1.4.13
    • Relative symlinks failing (out-of path file extraction)
  • Archive_Tar 1.4.12
  • Archive_Tar 1.4.11
  • Archive_Tar 1.4.10
    • Fix block padding when the file buffer length is a multiple of 512 and smaller than Archive_Tar buffer length
    • Don't try to copy username/groupname in chroot jail

• provides and obsoletes php7-pear-Archive_Tar, former location of PEAR/Archive/Tar.php

• Update to version 1.10.19

  • PEAR 1.10.12
    • adjust dependencies based on new releases
  • XML_Util 1.4.5
    • fix Trying to access array offset on value of type int

• Update to version 1.10.18

• Remove pear-cacheid-array-check.patch (upstreamed)

• Contents of .filemap are now sorted internally

• Sort contents of .filemap to make build reproducible

• Recommend php7-openssl to allow https sources to be used

• Modify metadata_dir for system configuration only

• Add /var/lib/pear directory where xml files are stored

• Cleanup %files section

• Only use the GPG keys of Chuck Burgess. Extracted from the Release Manager public keys.

• Add release versions of PEAR modules

• Install metadata files (registry, filemap, channels, ...) in /var/lib/pear/ instead of /usr/share/php7/PEAR/

• Update to version 1.10.17

It was discovered that PEAR incorrectly handled symbolic links in archives. A remote attacker could possibly use this issue to execute arbitrary code.

USN-5027-1 fixed a vulnerability in PEAR. This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that PEAR incorrectly handled symbolic links in archives. A remote attacker could possibly use this issue to execute arbitrary code.