The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

Two security updates have been released for PharStreamWrapper.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Drupal Security Team reports :

CVE-2019-11831: By-passing protection of Phar Stream Wrapper Interceptor.

In order to intercept file invocations like file_exists or stat on compromised Phar archives the base name has to be determined and checked before allowing to be handled by PHP Phar stream handling. The current implementation is vulnerable to path traversal leading to scenarios where the Phar archive to be assessed is not the actual (compromised) file.

- https://www.drupal.org/project/drupal/releases/7.67

  -     [SA-CORE-2019-007](https://www.drupal.org/SA-CORE-2019-0     07)     ([CVE-2019-11831](https://nvd.nist.gov/vuln/detail/CVE-2     019-11831))

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.67, 8.6.x prior to 8.6.16, or 8.7.x prior to 8.7.1. It is, therefore, affected by a path traversal vulnerability. This security release fixes third-party dependencies included in or required by Drupal core.

As described in TYPO3-PSA-2019-007: By-passing protection of Phar Stream Wrapper Interceptor: In order to intercept file invocations like file_exists or stat on compromised Phar archives the base name has to be determined and checked before allowing to be handled by PHP Phar stream handling. The current implementation is vulnerable to path traversal leading to scenarios where the Phar archive to be assessed is not the actual (compromised) file. (SA-CORE-2019-007)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Several security vulnerabilities have been discovered in drupal7, a PHP website platform. The vulnerabilities affect the embedded versions of the jQuery JavaScript library and the Typo3 Phar Stream Wrapper library.

CVE-2019-11358

It was discovered that the jQuery version embedded in Drupal was prone to a cross site scripting vulnerability in jQuery.extend().

For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2019-006.

CVE-2019-11831

It was discovered that incomplete validation in a Phar processing library embedded in Drupal, a fully-featured content management framework, could result in information disclosure.

For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2019-007.

For Debian 8 'Jessie', these problems have been fixed in version 7.32-1+deb8u17.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

-     [3.1.1](https://github.com/TYPO3/phar-stream-wrapper/rel     eases/tag/v3.1.1)

  -     [TYPO3-PSA-2019-007](https://typo3.org/security/advisory     /typo3-psa-2019-007/) /     [CVE-2019-11831](https://nvd.nist.gov/vuln/detail/CVE-20     19-11831)

  -     [TYPO3-PSA-2019-008](https://typo3.org/security/advisory     /typo3-psa-2019-008/) /     [CVE-2019-11830](https://nvd.nist.gov/vuln/detail/CVE-20     19-11830)

  -     [3.1.0](https://github.com/TYPO3/phar-stream-wrapper/rel     eases/tag/v3.1.0)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that incomplete validation in a Phar processing library embedded in Drupal, a fully-featured content management framework, could result in information disclosure.

For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2019-007.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.67, 8.6.x prior to 8.6.x, or 8.7.x prior to 8.7.1. It is, therefore, affected by a path traversal vulnerability. This security release fixes third-party dependencies included in or required by Drupal core. 
 As described in TYPO3-PSA-2019-007: By-passing protection of Phar Stream Wrapper Interceptor: In order to intercept file invocations like file_exists or stat on compromised Phar archives the base name has to be determined and checked before allowing to be handled by PHP Phar stream handling. The current implementation is vulnerable to path traversal leading to scenarios where the Phar archive to be assessed is not the actual (compromised) file.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.67, 8.7.x prior to 8.6.16, or 8.7.x prior to 8.7.1. It is, therefore, affected by a path traversal vulnerability. This security release fixes third-party dependencies included in or required by Drupal core.
As described in TYPO3-PSA-2019-007: By-passing protection of Phar Stream Wrapper Interceptor: In order to intercept file invocations like file_exists or stat on compromised Phar archives the base name has to be determined and checked before allowing to be handled by PHP Phar stream handling. The current implementation is vulnerable to path traversal leading to scenarios where the Phar archive to be assessed is not the actual (compromised) file. (SA-CORE-2019-007)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
126314	Fedora 29 : php-brumann-polyfill-unserialize / php-typo3-phar-stream-wrapper2 (2019-af7bef7165)	Nessus	Fedora Local Security Checks	critical
126265	Fedora 30 : php-brumann-polyfill-unserialize / php-typo3-phar-stream-wrapper2 (2019-a8121923d5)	Nessus	Fedora Local Security Checks	critical
125791	FreeBSD : drupal -- Drupal core - Moderately critical (9b8a52fc-89c1-11e9-9ba0-4c72b94353b5)	Nessus	FreeBSD Local Security Checks	critical
125430	Fedora 30 : drupal7 (2019-84a50e34a9)	Nessus	Fedora Local Security Checks	critical
125425	Fedora 28 : drupal7 (2019-41d6ffd6f0)	Nessus	Fedora Local Security Checks	critical
125418	Fedora 29 : drupal7 (2019-040857fd75)	Nessus	Fedora Local Security Checks	critical
98604	Drupal 7.x < 7.67 Third-Party Libraries Vulnerability	Web App Scanning	Component Vulnerability	critical
98603	Drupal 8.6.x < 8.6.16 Third-Party Libraries Vulnerability	Web App Scanning	Component Vulnerability	critical
98602	Drupal 8.7.x < 8.7.1 Third-Party Libraries Vulnerability	Web App Scanning	Component Vulnerability	critical
125298	Debian DLA-1797-1 : drupal7 security update	Nessus	Debian Local Security Checks	critical
125233	Fedora 29 : php-typo3-phar-stream-wrapper (2019-d5f883429d)	Nessus	Fedora Local Security Checks	critical
125231	Fedora 28 : php-typo3-phar-stream-wrapper (2019-4d93cf2b34)	Nessus	Fedora Local Security Checks	critical
125230	Fedora 30 : php-typo3-phar-stream-wrapper (2019-3c89837025)	Nessus	Fedora Local Security Checks	critical
125096	Debian DSA-4445-1 : drupal7 - security update	Nessus	Debian Local Security Checks	critical
700664	Drupal 7.x < 7.67 / 8.6.x < 8.6.16 / 8.7.x < 8.7.1 (SA-CORE-2019-007)	Nessus Network Monitor	CGI	critical
124698	Drupal 7.0.x < 7.67 / 8.6.x < 8.6.16 / 8.7.x < 8.7.1 Drupal Vulnerability (SA-CORE-2019-007)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-11831

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical