CVE-2020-7063
Files added to tar with Phar::buildFromIterator have all-access permissions
5.3
MEDIUM
CVSS 3.1
EPSS 0.30%
Description
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.
How to fix CVE-2020-7063
To remediate CVE-2020-7063, upgrade the affected package to a fixed version below.
- —upgrade to 7.2.28 or later
- —upgrade to 7.2.28 or later
- —upgrade to 7.2.28 or later
- —upgrade to 7.4.3-1 or later
Is CVE-2020-7063 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (4)
- >= 7.2.0, < 7.2.28, >= 7.3.0, < 7.3.15, >= 7.4.0, < 7.4.3
- >= 7.2.0, < 7.2.28, >= 7.3.0, < 7.3.15, >= 7.4.0, < 7.4.3
- >= 7.2.0, < 7.2.28, >= 7.3.0, < 7.3.15, >= 7.4.0, < 7.4.3
- from 0, < 7.4.3-1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |