Debian Security Advisory
DLA-2637-1 drupal7 -- LTS security update
- Date Reported:
- 23 Apr 2021
- Affected Packages:
- drupal7
- Vulnerable:
- Yes
- Security database references:
- No other external database security references currently available.
- More information:
-
The Drupal project identified a vulnerability in the sanitization performed in the _filter_xss_arttributes function, potentially allowing a cross-site scripting, and granted it the Drupal Security Advisory ID SA-CORE-2021-002:
https://www.drupal.org/sa-core-2021-002
No CVE number has been announced.
For Debian 9
Stretch
, the fix to this issue was backported in version 7.52-2+deb9u15.We recommend you upgrade your drupal7 package.
For detailed security status of drupal7, please refer to its security tracker page:
https://security-tracker.debian.org/tracker/source-package/drupal7
Further information about Debian LTS security advisories, how to apply these updates to your system, and other frequently asked questions can be found at:
https://wiki.debian.org/LTS
For Debian 9
Stretch
, these issues have been fixed in drupal7 version 7.52-2+deb9u15