PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-36193 PEAR CVE debrief

CVE-2020-36193 affects PEAR Archive_Tar and is described as an improper link resolution vulnerability. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-25, which means organizations should treat it as an active security concern and prioritize remediation. The supplied corpus points to a vendor fix commit and downstream advisories, but does not include fixed-version details in-line.

Vendor
PEAR
Product
Archive_Tar
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-08-25
Original CVE updated
2022-08-25
Advisory published
2022-08-25
Advisory updated
2022-08-25

Who should care

Administrators and developers who use PEAR Archive_Tar directly or through downstream software, especially systems that process or extract tar archives as part of application workflows.

Technical summary

The issue is classified as an improper link resolution vulnerability in PEAR Archive_Tar. Based on the supplied corpus, the most important operational fact is that CISA lists CVE-2020-36193 in the KEV catalog, with remediation due 2022-09-15. The corpus references a vendor commit and downstream advisories, so affected users should follow vendor instructions for the exact update path rather than relying on generalized assumptions about impact.

Defensive priority

High. KEV inclusion is a strong signal that this vulnerability is being exploited in the wild or has been observed as a credible threat, so remediation should be prioritized over routine maintenance.

Recommended defensive actions

  • Apply PEAR Archive_Tar updates according to the vendor instructions referenced by CISA.
  • Inventory applications and dependencies that bundle or rely on PEAR Archive_Tar.
  • Prioritize patching systems that process untrusted or externally supplied archives.
  • Review downstream advisories, including the referenced Drupal and Red Hat notices, for packaged fix guidance.
  • Validate remediation by confirming the affected component is no longer present or is at the fixed version.
  • Monitor relevant systems for unusual archive-extraction behavior until patching is complete.

Evidence notes

This debrief is limited to the supplied CISA KEV record and the official links provided in the corpus. The corpus confirms the CVE identifier, product, vulnerability class, KEV listing date, and remediation deadline, but it does not include full technical exploitation details or fixed-version data. No CVSS score was provided in the supplied metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2020-36193 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2020-36193

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2020-36193 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2020-36193

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.