[SECURITY] [DLA 2458-1] drupal7 security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2458-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
November 19, 2020 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : drupal7
Version : 7.52-2+deb9u12
CVE ID : CVE-2020-13666 CVE-2020-13671
Two vulnerabilities were discovered in Drupal, a fully-featured content
management framework.
CVE-2020-13666
The Drupal AJAX API did not disable JSONP by default, which could
lead to cross-site scripting.
For setups that relied on Drupal's AJAX API for JSONP requests,
either JSONP will need to be reenabled, or the jQuery AJAX API will
have to be used instead.
See the upstream advisory for more details:
https://www.drupal.org/sa-core-2020-007
CVE-2020-13671
Drupal failed to sanitize filenames on uploaded files, which could
lead to those files being served as the wrong MIME type, or being
executed depending on the server configuration.
It is also recommended to check previously uploaded files for
malicious extensions. For more details see the upstream advisory:
https://www.drupal.org/sa-core-2020-012
For Debian 9 stretch, these problems have been fixed in version
7.52-2+deb9u12.
We recommend that you upgrade your drupal7 packages.
For the detailed security status of drupal7 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/drupal7
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAl+2W0MACgkQnUbEiOQ2
gwLmVhAAroo0l1+hEh1VZ2QNj7kEoffcXZ35nvSXtsfFDDJcVarojRrBAHbK2BYa
sDljwaWMlo2chKoEsPNoXPCH17TEgyTHguU2YrX559Z1bDF4/Wj1rXEBUzwRl/Mc
uh5fXkOzASfDxnS8p1e2Qh/ksnIf1Z1CC7DvzdOfBOmqQs5s+3zgd9uYiikHX8NR
Ucbh3Ji2doCrYh3ZfH0eTujg7KLySjp4hdb8ocgQLMULV8f/ybdm7CA8eB1SWSj0
cbr7qjDye3Ig3xFvdBmUvRXrBGKakuN8c4rpV+tIKrQiOyARubsH0IMfOP6aJVLl
Zn9cdNrGN6DJd2LVXfmJNcyci62kIL99q+TeQntNwYfRASyWHLyPylYmJhrcnK++
EJhonrHd9SorQkbvlpDn/C0E/zILoA9fENygTb990mSnPSqnsjlWpbkofpGESIZJ
JGmXJfV6vTuZ5ms+rcnp2w8+S8gvZQhDxZb01U+N8U+3EOYGkRi0K2P9hb4SboXg
pUSGYa6twbQDm5XzReVEipAuqGSyH22agCckGAiZmluz3iikgQF+GYfa/n/XQirB
zq5GGYyiZOvkcVg5pQWGgzcj7KZxDvnvyAY2N+SaN2ohqWYMKgN+Z8pyc3TSHd7G
3NqWZ6BmNJo6A24xn72fmdJJcvHlbw698KgcHgTTBeQjs5ImIJc=
=r4OE
-----END PGP SIGNATURE-----
Reply to: