CVE-2019-6338 third-party PEAR Archive_Tar library updates

2019-01-2215:00:00

drupal

www.cve.org

8.2 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

81.0%

JSON

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details

CNA Affected

[
  {
    "product": "Drupal core",
    "vendor": "Drupal",
    "versions": [
      {
        "lessThan": "7.62",
        "status": "affected",
        "version": "7.x",
        "versionType": "custom"
      },
      {
        "lessThan": "8.6.6. ",
        "status": "affected",
        "version": "8.6.x",
        "versionType": "custom"
      },
      {
        "lessThan": "8.5.9",
        "status": "affected",
        "version": "8.5.x",
        "versionType": "custom"
      }
    ]
  }
]