Exploited vulnerability · CISA KEV

Is CVE-2020-36193 exploited? Yes: in CISA KEV since 25 Aug 2022

Gociux · PEAR Archive_Tar · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2020-36193, PEAR Archive_Tar Improper Link Resolution Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 25 Aug 2022, 584 days after it was published. It affects PEAR Archive_Tar. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.

What to do

1. Check whether you run it. Look for Archive_Tar in your asset inventory, including appliances and cloud images. Stack check lists every exploited PEAR CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 18 Jan 2021.
4. Get told next time. Email alerts when CISA adds a CVE for PEAR.

Other exploited CVEs in Archive_Tar

• CVE-2020-28949: PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability (25 Aug 2022)

References

• github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389
• nvd.nist.gov/vuln/detail/CVE-2020-36193

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in August 2022 · PEAR scorecard · act-now radar.