TYPO3/phar-stream-wrapper

TYPO3/phar-stream-wrapper

Releases28

Frequency2 months 3 weeks

Last Release over 1 year ago

Stars59

Interceptors for PHP's native phar:// stream handling in order to enhance security.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2019-11831 ↗	May 9, 2019Thursday, 9 May 2019, 04:29	9.8 CRITICAL	7.5 HIGH
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
CVE-2019-11830 ↗	May 9, 2019Thursday, 9 May 2019, 04:29	—	7.5 HIGH
PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandles Phar stub parsing, which allows attackers to bypass a deserialization protection mechanism.