p PatchFirst

PatchFirst · Latest vulnerabilities

typo3/phar-stream-wrapper vulnerabilities

Vulnerabilities published for typo3/phar-stream-wrapper in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. GHSA-4v5g-8pq2-32m2

    Not ratedFix available

    By-passing Protection of PharStreamWrapper Interceptor

    Insecure deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application. In July 2018, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the TYPO3 core. For more details read the corresponding TYPO3 advisory. In addition, a new interceptor was introduced to protect possible (but unknown) vulnerabilities in 3rd party components like TYPO3 extensions. Basically, the PharStreamWrapper intercepts direct invocations of Phar archives and allows or denies further processing based on individual rules. Recently, the PharStr

    typo3/phar-stream-wrapper typo3/phar-stream-wrapperPHP
    • Update to 2.0.1
    • Update to 3.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2019-11831

    Critical · CVSS 9.8EPSS 5.44%Fix available

    CVE-2019-11831

    The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

    typo3/phar-stream-wrapper typo3/phar-stream-wrapperPHP
    • Update to 2.1.1
    • Update to 3.1.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →