PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-36193 PEAR CVE debrief

CVE-2020-36193 affects PEAR Archive_Tar and is described as an improper link resolution vulnerability. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-25, which means organizations should treat it as an active security concern and prioritize remediation. The supplied corpus points to a vendor fix commit and downstream advisories, but does not include fixed-version details in-line.

Vendor
PEAR
Product
Archive_Tar
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-08-25
Original CVE updated
2022-08-25
Advisory published
2022-08-25
Advisory updated
2022-08-25

Who should care

Administrators and developers who use PEAR Archive_Tar directly or through downstream software, especially systems that process or extract tar archives as part of application workflows.

Technical summary

The issue is classified as an improper link resolution vulnerability in PEAR Archive_Tar. Based on the supplied corpus, the most important operational fact is that CISA lists CVE-2020-36193 in the KEV catalog, with remediation due 2022-09-15. The corpus references a vendor commit and downstream advisories, so affected users should follow vendor instructions for the exact update path rather than relying on generalized assumptions about impact.

Defensive priority

High. KEV inclusion is a strong signal that this vulnerability is being exploited in the wild or has been observed as a credible threat, so remediation should be prioritized over routine maintenance.

Recommended defensive actions

  • Apply PEAR Archive_Tar updates according to the vendor instructions referenced by CISA.
  • Inventory applications and dependencies that bundle or rely on PEAR Archive_Tar.
  • Prioritize patching systems that process untrusted or externally supplied archives.
  • Review downstream advisories, including the referenced Drupal and Red Hat notices, for packaged fix guidance.
  • Validate remediation by confirming the affected component is no longer present or is at the fixed version.
  • Monitor relevant systems for unusual archive-extraction behavior until patching is complete.

Evidence notes

This debrief is limited to the supplied CISA KEV record and the official links provided in the corpus. The corpus confirms the CVE identifier, product, vulnerability class, KEV listing date, and remediation deadline, but it does not include full technical exploitation details or fixed-version data. No CVSS score was provided in the supplied metadata.

Official resources

CISA added CVE-2020-36193 to the Known Exploited Vulnerabilities catalog on 2022-08-25. The supplied corpus also references a PEAR Archive_Tar fix commit and downstream advisories from Drupal and Red Hat, indicating public remediation and a