CVE-2019-6338: third-party PEAR Archive_Tar library updates

Severity: high (CVSS 8.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-22 · updated 2026-06-17
Weakness: CWE-502

Description

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details

Affected products

Debian Linux: 8.0, 9.0
Drupal: from 7.0 before 7.62; from 8.5.0 before 8.5.9; from 8.6.0 before 8.6.6 — fixed in 7.62, 8.5.9, 8.6.6

How to fix

Upgrade to a fixed version: Drupal 7.62, 8.5.9, 8.6.6. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/106706
https://lists.debian.org/debian-lts-announce/2019/02/msg00032.html
https://www.debian.org/security/2019/dsa-4370
https://www.drupal.org/sa-core-2019-001
http://www.securityfocus.com/bid/106706
https://lists.debian.org/debian-lts-announce/2019/02/msg00032.html
https://www.debian.org/security/2019/dsa-4370
https://www.drupal.org/sa-core-2019-001

Get alerted when CVE-2019-6338 or the next vulnerability affects your stack