diff --git a/.gitignore b/.gitignore
index abd0799..021fc10 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,4 @@
-SOURCES/Archive_Tar-1.3.11.tgz
+SOURCES/Archive_Tar-1.4.14.tgz
 SOURCES/Console_Getopt-1.3.1.tgz
 SOURCES/PEAR-1.9.4.tgz
 SOURCES/Structures_Graph-1.0.4.tgz
diff --git a/.php-pear.metadata b/.php-pear.metadata
index 6203890..6726a7e 100644
--- a/.php-pear.metadata
+++ b/.php-pear.metadata
@@ -1,4 +1,4 @@
-a07ecdacdb180816be941550a8c4dbeeb4bbb110 SOURCES/Archive_Tar-1.3.11.tgz
+ef023e94c632e80ef78ddfee19e4af6abc54eed4 SOURCES/Archive_Tar-1.4.14.tgz
 8f9ac495728ee9ba87edd109c3946f11ee72bc08 SOURCES/Console_Getopt-1.3.1.tgz
 7c4e88ae5064827507b2c9ae0108eb5972d900db SOURCES/PEAR-1.9.4.tgz
 00f5c2aefad0c3f6490e5ca95da87828e64ebc57 SOURCES/Structures_Graph-1.0.4.tgz
diff --git a/SPECS/php-pear.spec b/SPECS/php-pear.spec
index 3a582e6..7effc9f 100644
--- a/SPECS/php-pear.spec
+++ b/SPECS/php-pear.spec
@@ -2,7 +2,7 @@
 %global metadir %{_localstatedir}/lib/pear
 
 %global getoptver 1.3.1
-%global arctarver 1.3.11
+%global arctarver 1.4.14
 # https://pear.php.net/bugs/bug.php?id=19367
 # Structures_Graph 1.0.4 - incorrect FSF address
 %global structver 1.0.4
@@ -15,7 +15,7 @@
 Summary: PHP Extension and Application Repository framework
 Name: php-pear
 Version: 1.9.4
-Release: 22%{?dist}
+Release: 23%{?dist}
 Epoch: 1
 # PEAR, Archive_Tar, XML_Util are BSD
 # Console_Getopt is PHP
@@ -287,6 +287,10 @@ fi
 
 
 %changelog
+* Thu Sep 22 2022 Remi Collet <rcollet@redhat.com> 1:1.9.4-23
+- update Archive_Tar to 1.4.14
+  CVE-2020-36193 CVE-2020-28948 CVE-2020-28949
+
 * Wed Apr 15 2020 Remi Collet <rcollet@redhat.com> 1:1.9.4-22
 - fix fatal error: gnu/stubs-64.h: No such file or directory #1720375