{"action":"Upgrade drupal/drupal to 7.62.0 or later.","affected":[{"fixed":"7.62.0","introduced":"7.0.0"},{"fixed":"8.5.9","introduced":"8.0.0"},{"fixed":"8.6.6","introduced":"8.6.0"}],"component":"drupal/drupal","cve_ids":["CVE-2019-6338"],"ecosystem":"Packagist","epss":0.0212,"exploited":false,"fixed_versions":["7.62.0","8.5.9","8.6.6"],"ghsa_id":"GHSA-6rmq-x2hv-vxpp","id":"tcs_01M5KEXBNDG2QPTECKT4H00P2T","modified_at":"2025-12-10T23:40:59.245360Z","published_at":"2019-12-02T18:11:25Z","references":["https://osv.dev/vulnerability/GHSA-6rmq-x2hv-vxpp","https://nvd.nist.gov/vuln/detail/CVE-2019-6338","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6338.yaml","https://lists.debian.org/debian-lts-announce/2019/02/msg00032.html","https://www.debian.org/security/2019/dsa-4370","https://www.drupal.org/sa-core-2019-001","http://www.securityfocus.com/bid/106706"],"severity":{"label":"high","score":8},"sources":[{"source":"osv","source_id":"GHSA-6rmq-x2hv-vxpp","url":"https://osv.dev/vulnerability/GHSA-6rmq-x2hv-vxpp"}],"summary":"Drupal core third-party PEAR Archive_Tar library is vulnerable to Deserialization of Untrusted Data"}