PEAR Archive_Tar improper link resolution (CVE-2020-36193) — a component nobody remembers installing, running inside products

1A component running under a name you do not know

Archive_Tar is a PHP component for reading and writing tar archives. Most people have never heard of it, and use it anyway. That is presumably why the catalog adds its note about products built by others. Strictly, naming third-party products is not part of describing a vulnerability.

Without it, though, the description never reaches the people who need to act, because they do not know a component by that name is running in their environment.

2Not using it directly does not mean not being affected

Unpacking an archive is a classic case of handling a file that arrived from outside. Where link checking is loose, writes can land somewhere that was never meant to receive them. Hence two classifications: the limitation on pathnames and the following of links both take part.

3What two classifications mean

Only 6.0% of entries carry more than one classification. Some flaws are not a single weakness but a pair that has to line up before anything works. Fix one and leave the other, and a different route can remain open. Note too that a component this widely deployed has appeared in the catalog twice. How rarely something is listed says nothing about how far it reaches.

4Who does the fixing

From the position of someone using it, the party who must fix it is often not you. Component updates arrive as product updates, so waiting is frequently the only option. Even then, knowing what is inside at least allows the question of whether this concerns you to be answered. That the catalog names third-party products reads as help toward exactly that judgment.