GHSA-6rmq-x2hv-vxpp

    Dashboard / Vulnerabilities / GHSA-6rmq-x2hv-vxpp

    GHSA-6rmq-x2hv-vxpp

    Published: 2 Dec 2019Last Modified: 10 Dec 2025

    Summary: Drupal core third-party PEAR Archive_Tar library is vulnerable to Deserialization of Untrusted Data

    Details: In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details

    References: https://nvd.nist.gov/vuln/detail/CVE-2019-6338, https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6338.yaml, https://lists.debian.org/debian-lts-announce/2019/02/msg00032.html, https://www.debian.org/security/2019/dsa-4370, https://www.drupal.org/sa-core-2019-001, http://www.securityfocus.com/bid/106706

    Affected packages

    Package

    Name: drupal/drupal

    Purl: pkg:composer/drupal/drupal

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 7.0.0
    Fixed -7.62.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High