{"id":"CVE-2020-28949","aliases":["ALPINE-CVE-2020-28949","ALSA-2022:6542","BIT-drupal-2020-28948","BIT-drupal-2020-28949","DEBIAN-CVE-2020-28949","DLA-2465-1","DLA-2466-1","DRUPAL-CORE-2020-013","DSA-4817-1","EUVD-2021-0783","GHSA-75c5-f4gw-38r9","MGASA-2020-0453","RHSA-2022:6541","RHSA-2022:6542","RHSA-2022:7340","RLSA-2022:6542","UBUNTU-CVE-2020-28949","USN-4654-1","USN-6981-1","USN-6981-2"],"status":"published","title":"Multiple vulnerabilities through filename manipulation in Archive_Tar","description":"Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.84554,"percentile":0.99705,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-502","CWE-74"],"published":"2020-11-19T18:14:18Z","modified":"2026-11-03T06:32:25Z","kev":{"date_added":"2022-08-25","due_date":"2022-09-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-08-25"},{"source":"kev","since":"2022-08-25"}],"exploits":[{"source":"metasploit","id":"exploit/multi/fileformat/archive_tar_arb_file_write","title":"PEAR Archive_Tar 1.4.10 Arbitrary File Write","type":"exploit","platform":"PHP","date":"2020-11-17","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/fileformat/archive_tar_arb_file_write"}],"fixes":[{"ecosystem":"Packagist","package":"pear/archive_tar","fixed_in":["1.4.11"],"sources":["ghsa"]},{"ecosystem":"Alpine:v3.11","package":"drupal7","fixed_in":["7.75-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"drupal7","fixed_in":["7.75-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"drupal7","fixed_in":["7.75-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"drupal7","fixed_in":["7.75-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"drupal7","fixed_in":["7.75-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"drupal7","fixed_in":["7.75-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"drupal7","fixed_in":["7.75-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"drupal7","fixed_in":["7.75-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"drupal7","fixed_in":["7.75-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"drupal7","fixed_in":["7.75-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"php-pear","fixed_in":["1:1.10.9+submodules+notgz-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-pear","fixed_in":["1:1.10.9+submodules+notgz-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-pear","fixed_in":["1:1.10.9+submodules+notgz-1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","fixed_in":["7.26-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"php-pear","fixed_in":["1:1.10.1+submodules+notgz-6ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"drupal7","fixed_in":["7.44-1ubuntu1~16.04.0+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"php-pear","fixed_in":["1:1.10.5+submodules+notgz-1ubuntu1.18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"php-pear","fixed_in":["1:1.10.9+submodules+notgz-1ubuntu0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"pear/archive_tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.75-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.75-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.75-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.75-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.75-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.75-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.75-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.75-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.75-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.75-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apcu-panel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.18-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libzip-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libzip-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libzip-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libzip-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.13-1.module_el8.6.0+3268+b150a051"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.18-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.18-1.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-apcu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.18-1.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-apcu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.18-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-xdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-1.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-xdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.2-1.module_el8.6.0+2750+78feabcb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.2-1.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3238+624bf8b8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.19-4.module_el8.6.0+3239+bedf0508"}]}],"bundled":3},{"source":"osv","ecosystem":"Bitnami","package":"drupal","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.75.0"},{"introduced":"8.0.0"},{"fixed":"8.9.10"},{"introduced":"9.0.0"},{"fixed":"9.0.9"}]}],"bundled":2},{"source":"osv","ecosystem":"Bitnami","package":"drupal","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.75.0"},{"introduced":"8.0.0"},{"fixed":"8.9.10"},{"introduced":"9.0.0"},{"fixed":"9.0.9"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.9+submodules+notgz-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.9+submodules+notgz-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.9+submodules+notgz-1.1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.1+submodules+notgz-9+deb9u2"}]}],"versions":["1:1.10.1+submodules+notgz-9","1:1.10.1+submodules+notgz-9+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52-2+deb9u13"}]}],"versions":["7.52-2","7.52-2+deb9u1","7.52-2+deb9u10","7.52-2+deb9u11","7.52-2+deb9u12","7.52-2+deb9u2","7.52-2+deb9u3","7.52-2+deb9u4","7.52-2+deb9u5","7.52-2+deb9u6","7.52-2+deb9u7","7.52-2+deb9u8","7.52-2+deb9u9"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.8.12"}]},{"type":"ECOSYSTEM","events":[{"introduced":"8.9.0"},{"fixed":"8.9.10"}]},{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.9"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.1.0","8.1.0-beta1","8.1.0-beta2","8.1.0-rc1","8.1.1","8.1.10","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6","8.2.7","8.2.8","8.3.0","8.3.0-alpha1","8.3.0-beta1","8.3.0-rc1","8.3.0-rc2","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.3.6","8.3.7","8.3.8","8.3.9","8.4.0","8.4.0-alpha1","8.4.0-beta1","8.4.0-rc1","8.4.0-rc2","8.4.1","8.4.2","8.4.3","8.4.4","8.4.5","8.4.6","8.4.7","8.4.8","8.5.0","8.5.0-alpha1","8.5.0-beta1","8.5.0-rc1","8.5.1","8.5.10","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.7","8.5.8","8.5.9","8.6.0","8.6.0-alpha1","8.6.0-beta1","8.6.0-beta2","8.6.0-rc1","8.6.1","8.6.10","8.6.11","8.6.12","8.6.13","8.6.14","8.6.15","8.6.16","8.6.17","8.6.18","8.6.2","8.6.3","8.6.4","8.6.5","8.6.6","8.6.7","8.6.8","8.6.9","8.7.0","8.7.0-alpha1","8.7.0-alpha2","8.7.0-beta1","8.7.0-beta2","8.7.0-rc1","8.7.1","8.7.10","8.7.11","8.7.12","8.7.13","8.7.14","8.7.2","8.7.3","8.7.4","8.7.5","8.7.6","8.7.7","8.7.8","8.7.9","8.8.0","8.8.0-alpha1","8.8.0-beta1","8.8.0-rc1","8.8.1","8.8.10","8.8.11","8.8.2","8.8.3","8.8.4","8.8.5","8.8.6","8.8.7","8.8.8","8.8.9","8.9.0","8.9.1","8.9.2","8.9.3","8.9.4","8.9.5","8.9.6","8.9.7","8.9.8","8.9.9","9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.6+submodules+notgz-1.1+deb10u1"}]}],"versions":["1:1.10.6+submodules+notgz-1.1"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"pear/archive_tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11"}]}],"versions":["1.3.11","1.3.12","1.3.13","1.3.14","1.3.15","1.3.16","1.4.0","1.4.1","1.4.10","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"pear/archive_tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11"}]}],"versions":["1.3.11","1.3.12","1.3.13","1.3.14","1.3.15","1.3.16","1.4.0","1.4.1","1.4.10","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.9-1.1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"apcu-panel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libzip-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libzip-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libzip-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"libzip-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-bcmath-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-cli-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-dba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-dbg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-embedded-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-enchant-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-ffi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-fpm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-gd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-gmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-intl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-json-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-mbstring-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-mysqlnd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-opcache-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pdo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.13-1.module+el8.4.0+16578+ed65e99e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-apcu-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-apcu-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-apcu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-rrd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-rrd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-xdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.5-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-xdebug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.5-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-xdebug-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.5-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-zip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pecl-zip-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-process-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-soap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-xml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"php-xmlrpc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.6-5.module+el8.4.0+15727+276bb227"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apcu-panel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libzip-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libzip-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libzip-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libzip-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-bcmath-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-cli-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-dba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-dbg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-embedded-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-enchant-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-ffi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-fpm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-gd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-gmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-intl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-json-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-mbstring-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-mysqlnd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-opcache-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pdo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.13-1.module+el8.6.0+16577+0788886f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-apcu-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-apcu-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-apcu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-rrd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-rrd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-xdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.5-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-xdebug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.5-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-xdebug-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.5-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-zip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pecl-zip-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.3.0+6678+b09f589e"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-process-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-soap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-xml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"php-xmlrpc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+16316+906f6c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.9.4-23.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.9.4-23.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.6.0+789+2130c178"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-1.module+el8.4.0+415+e936cba3"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-4.module+el8.6.0+1006+0d5a469f"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.13-1.module+el8.7.0+1067+0a7071cc"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.13-1.module+el8.6.0+1006+0d5a469f"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.6.0+789+2130c178"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.18-1.module+el8.4.0+415+e936cba3"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.module+el8.4.0+414+2e7afcdd"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pecl-xdebug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.5-1.module+el8.4.0+415+e936cba3"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.6.0+789+2130c178"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.2-1.module+el8.4.0+415+e936cba3"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.26-1ubuntu0.1+esm2"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.1+submodules+notgz-6ubuntu0.2"}]}],"versions":["1:1.10.1+submodules+notgz-4","1:1.10.1+submodules+notgz-6","1:1.10.1+submodules+notgz-6ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.44-1ubuntu1~16.04.0+esm2"}]}],"versions":["7.38-1","7.41-1","7.44-1ubuntu1~16.04.0","7.44-1ubuntu1~16.04.0+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.5+submodules+notgz-1ubuntu1.18.04.2"}]}],"versions":["1:1.10.5+submodules+notgz-1","1:1.10.5+submodules+notgz-1ubuntu1","1:1.10.5+submodules+notgz-1ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.9+submodules+notgz-1ubuntu0.20.04.1"}]}],"versions":["1:1.10.9+submodules+notgz-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.1+submodules+notgz-6ubuntu0.2"}]}],"versions":["1:1.10.1+submodules+notgz-4","1:1.10.1+submodules+notgz-6","1:1.10.1+submodules+notgz-6ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.5+submodules+notgz-1ubuntu1.18.04.2"}]}],"versions":["1:1.10.5+submodules+notgz-1","1:1.10.5+submodules+notgz-1ubuntu1","1:1.10.5+submodules+notgz-1ubuntu1.18.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php-pear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.9+submodules+notgz-1ubuntu0.20.04.1"}]}],"versions":["1:1.10.9+submodules+notgz-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.44-1ubuntu1~16.04.0+esm2"}]}],"versions":["7.38-1","7.41-1","7.44-1ubuntu1~16.04.0","7.44-1ubuntu1~16.04.0+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.26-1ubuntu0.1+esm2"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"drupal","product":"drupal"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"pear","product":"archive_tar"},{"vendor":"php","product":"archive_tar"}],"references":[{"url":"https://github.com/pear/Archive_Tar/issues/33","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory","advisory","report","web"]},{"url":"https://www.drupal.org/sa-core-2020-013","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://www.debian.org/security/2020/dsa-4817","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence","web"]},{"url":"https://security.gentoo.org/glsa/202101-23","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-28949","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28949","tags":["web","advisory"]},{"url":"https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/pear/archive_tar/CVE-2020-28949.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBYZSHYTIOBK6V7C4N7TP6KIKCRKLVWP","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR","tags":["web"]},{"url":"https://github.com/advisories/GHSA-75c5-f4gw-38r9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-28949","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6542","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28948","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28949","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-36193","tags":["report"]},{"url":"https://bugzilla.redhat.com/1904001","tags":["report"]},{"url":"https://bugzilla.redhat.com/1910323","tags":["report"]},{"url":"https://bugzilla.redhat.com/1942961","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-6542.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28948","tags":["web","advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-28949","tags":["advisory"]},{"url":"https://github.com/pear/Archive_Tar","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0453.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27664","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2465","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4V35LBRM6HBCXBVCITKQ4UEBTXO2EG7B/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4654-1","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6541","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1904001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1910323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1942961","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6541.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28948","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28949","tags":["advisory","report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36193","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6542.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7340","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7340.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:6542","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-28949","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6981-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6981-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-28948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13671","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-28949","description":"Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.","status":"published","published":"2020-11-19T18:14:18Z","modified":"2025-10-21T23:35:32.687Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:57.017407Z"}],"euvd":[{"id":"EUVD-2021-0783","description":"Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.","status":"published","published":"2020-11-19T18:14:18Z","modified":"2025-10-21T23:35:32Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-08-25","updated_at":"2026-11-02T20:31:25.308373Z"}],"ghsa":[{"id":"GHSA-75c5-f4gw-38r9","title":"Multiple vulnerabilities through filename manipulation in Archive_Tar","description":"Archive_Tar through 1.4.10 has `://` filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as `file://` to overwrite files) can still succeed. See: https://github.com/pear/Archive_Tar/issues/33","status":"published","published":"2021-04-22T16:20:59Z","modified":"2025-10-22T17:56:53Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2020-28949","title":"PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability","description":"PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.","cwes":["CWE-74"],"kev":{"date_added":"2022-08-25","due_date":"2022-09-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2020-28949","description":"Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.","status":"published","published":"2020-11-19T19:15:11.937Z","modified":"2026-06-17T03:10:53.81Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:25.394006Z"}],"osv":[{"id":"ALPINE-CVE-2020-28949","description":"Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.","status":"published","published":"2020-11-19T19:15:11.937Z","modified":"2026-11-03T06:32:25.629022754Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-28948","description":"Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.","status":"published","published":"2020-11-19T19:15:11.877Z","modified":"2026-10-24T10:50:03.667995336Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"CVE-2020-28949","description":"Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.","status":"published","published":"2020-11-19T19:15:11.937Z","modified":"2026-10-24T10:50:03.666192988Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-28949","description":"Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.","status":"published","published":"2020-11-19T19:15:11.937Z","modified":"2026-10-26T12:01:58.407472119Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"GHSA-75c5-f4gw-38r9","title":"Multiple vulnerabilities through filename manipulation in Archive_Tar","description":"Archive_Tar through 1.4.10 has `://` filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as `file://` to overwrite files) can still succeed. See: https://github.com/pear/Archive_Tar/issues/33","status":"published","published":"2021-04-22T16:20:59Z","modified":"2025-12-10T23:40:57.172131Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"GHSA-jh5x-hfhg-78jq","title":"Deserialization of Untrusted Data in Archive_Tar","description":"Archive_Tar through 1.4.10 allows an unserialization attack because `phar:` is blocked but `PHAR:` is not blocked. See: https://github.com/pear/Archive_Tar/issues/33","status":"published","published":"2021-04-22T16:20:50Z","modified":"2025-12-10T23:40:57.172131Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"RHSA-2022:6541","title":"Red Hat Security Advisory: php:7.4 security update","status":"published","published":"2024-09-16T08:59:11Z","modified":"2025-11-22T12:38:20Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:6542","title":"Red Hat Security Advisory: php:7.4 security update","status":"published","published":"2024-09-16T08:59:01Z","modified":"2025-11-22T12:38:21Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:7340","title":"Red Hat Security Advisory: php-pear security update","status":"published","published":"2024-09-16T08:59:18Z","modified":"2025-11-22T12:40:06Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:6542","title":"Moderate: php:7.4 security update","description":"PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.\n\nSecurity Fix(es):\n\n* Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked (CVE-2020-28948)\n\n* Archive_Tar: improper filename sanitization leads to file overwrites (CVE-2020-28949)\n\n* Archive_Tar: directory traversal due to inadequate checking of symbolic links (CVE-2020-36193)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-09-15T08:06:55Z","modified":"2026-02-04T13:30:09.22773Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2020-28949","description":"Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.","status":"published","published":"2020-11-19T19:15:00Z","modified":"2026-02-04T03:39:00.749558Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"ALSA-2022:6542","title":"Moderate: php:7.4 security update","description":"PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.\n\nSecurity Fix(es):\n\n* Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked (CVE-2020-28948)\n* Archive_Tar: improper filename sanitization leads to file overwrites (CVE-2020-28949)\n* Archive_Tar: directory traversal due to inadequate checking of symbolic links (CVE-2020-36193)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-09-15T00:00:00Z","modified":"2026-10-29T11:01:47.346597732Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"BIT-drupal-2020-28948","description":"Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.","status":"published","published":"2024-03-06T10:56:10.686Z","modified":"2026-09-08T08:47:02.560510181Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"BIT-drupal-2020-28949","description":"Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.","status":"published","published":"2024-03-06T10:56:00.687Z","modified":"2026-09-08T08:47:04.395571134Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"DLA-2465-1","title":"php-pear - security update","status":"published","published":"2020-11-23T00:00:00Z","modified":"2026-03-09T01:22:57.442355Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-2466-1","title":"drupal7 - security update","status":"published","published":"2020-11-26T00:00:00Z","modified":"2026-03-09T01:18:02.894259Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DRUPAL-CORE-2020-013","description":"The Drupal project uses the PEAR Archive\\_Tar library. The PEAR Archive\\_Tar library has released a security update that impacts Drupal. For more information please see:\n\n* [CVE-2020-28948](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28948)\n* [CVE-2020-28949](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28949)\n\nMultiple vulnerabilities are possible if Drupal is configured to allow `.tar`, `.tar.gz`, `.bz2`, or `.tlz` file uploads and processes them.\n\n**To mitigate this issue, prevent untrusted users from uploading `.tar`, `.tar.gz`, `.bz2`, or `.tlz` files.**\n\nThis is a different issue than [SA-CORE-2019-012](https://www.drupal.org/sa-core-2019-012). Similar configuration changes may mitigate the problem until you are able to patch.","status":"published","published":"2020-11-25T23:57:48Z","modified":"2026-09-19T17:39:28Z","updated_at":"2026-11-02T15:46:13.900249Z"},{"id":"DSA-4817-1","title":"php-pear - security update","status":"published","published":"2020-12-19T00:00:00Z","modified":"2026-03-09T02:11:13.290433Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0453","title":"Updated php-pear packages fix security vulnerabilities","description":"Filename manipulation vulnerabilities (CVE-2020-28948 / CVE-2020-28949)\nUpdated also Archive_Tar to 1.4.11.\n","status":"published","published":"2020-12-08T10:40:32Z","modified":"2026-04-16T04:40:51.129691504Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"USN-4654-1","title":"php-pear vulnerabilities","description":"It was discovered that PEAR incorrectly sanitized filenames. A remote\nattacker could possibly use this issue to execute arbitrary code.\n","status":"published","published":"2020-12-01T12:38:57Z","modified":"2026-02-10T04:41:59Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-6981-1","title":"drupal7 vulnerabilities","description":"It was discovered that Drupal incorrectly sanitized uploaded filenames. A\nremote attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-13671)\n\nIt was discovered that Drupal incorrectly sanitized archived filenames. A\nremote attacker could possibly use this issue to overwrite arbitrary files,\nor execute arbitrary code. (CVE-2020-28948, CVE-2020-28949)\n","status":"published","published":"2024-08-27T16:57:24Z","modified":"2026-06-25T13:32:28.791289361Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-6981-2","title":"drupal7 vulnerabilities","description":"USN-6981-1 fixed vulnerabilities in Drupal. This update provides the\ncorresponding updates for Ubuntu 14.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Drupal incorrectly sanitized uploaded filenames. A\n remote attacker could possibly use this issue to execute arbitrary code.\n (CVE-2020-13671)\n \n It was discovered that Drupal incorrectly sanitized archived filenames. A\n remote attacker could possibly use this issue to overwrite arbitrary\n files, or execute arbitrary code. (CVE-2020-28948, CVE-2020-28949)\n","status":"published","published":"2024-09-03T15:12:58Z","modified":"2026-06-29T13:46:59.149373777Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}