[3.9] drupal7: TYP03 does not prevent directory traversal resulting in bypass of deserialization of protection mechanism in phar-stream-wrapper (CVE-2019-11831)| ID: oval:org.secpod.oval:def:1801434 | Date: (C)2019-06-07 (M)2023-11-10 |
| Class: PATCH | Family: unix |
The PharStreamWrapper package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL. Fixed In Version:¶ drupal 7.67
| Platform: |
| Alpine Linux 3.9 |
