Packagist/drupal/core CVE-2020-28948, CVE-2020-28949: unknown, EPSS 47.49%

The Drupal project uses the PEAR Archive\_Tar library. The PEAR Archive\_Tar library has released a security update that impacts Drupal. For more information please see:

Action: Upgrade drupal/core to 8.8.12 or later.

composer require drupal/core:8.8.12

composer require drupal/core:8.9.10

composer require drupal/core:9.0.9

Affected

introduced	fixed	last affected
8.0.0	8.8.12	-
8.9.0	8.9.10	-
9.0.0	9.0.9	-

Fixed versions

8.8.12

8.9.10

9.0.9

Sources

osv: DRUPAL-CORE-2020-013
https://www.drupal.org/sa-core-2020-013

CVE-2020-28948, CVE-2020-28949 · published 2020-11-25T23:57:48Z · modified 2026-09-19T17:39:28Z · JSON