-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2458-1 debian-...@lists.debian.org https://www.debian.org/lts/security/ Emilio Pozuelo Monfort November 19, 2020 https://wiki.debian.org/LTS - -------------------------------------------------------------------------
Package : drupal7 Version : 7.52-2+deb9u12 CVE ID : CVE-2020-13666 CVE-2020-13671 Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. CVE-2020-13666 The Drupal AJAX API did not disable JSONP by default, which could lead to cross-site scripting. For setups that relied on Drupal's AJAX API for JSONP requests, either JSONP will need to be reenabled, or the jQuery AJAX API will have to be used instead. See the upstream advisory for more details: https://www.drupal.org/sa-core-2020-007 CVE-2020-13671 Drupal failed to sanitize filenames on uploaded files, which could lead to those files being served as the wrong MIME type, or being executed depending on the server configuration. It is also recommended to check previously uploaded files for malicious extensions. For more details see the upstream advisory: https://www.drupal.org/sa-core-2020-012 For Debian 9 stretch, these problems have been fixed in version 7.52-2+deb9u12. We recommend that you upgrade your drupal7 packages. For the detailed security status of drupal7 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/drupal7 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAl+2W0MACgkQnUbEiOQ2 gwLmVhAAroo0l1+hEh1VZ2QNj7kEoffcXZ35nvSXtsfFDDJcVarojRrBAHbK2BYa sDljwaWMlo2chKoEsPNoXPCH17TEgyTHguU2YrX559Z1bDF4/Wj1rXEBUzwRl/Mc uh5fXkOzASfDxnS8p1e2Qh/ksnIf1Z1CC7DvzdOfBOmqQs5s+3zgd9uYiikHX8NR Ucbh3Ji2doCrYh3ZfH0eTujg7KLySjp4hdb8ocgQLMULV8f/ybdm7CA8eB1SWSj0 cbr7qjDye3Ig3xFvdBmUvRXrBGKakuN8c4rpV+tIKrQiOyARubsH0IMfOP6aJVLl Zn9cdNrGN6DJd2LVXfmJNcyci62kIL99q+TeQntNwYfRASyWHLyPylYmJhrcnK++ EJhonrHd9SorQkbvlpDn/C0E/zILoA9fENygTb990mSnPSqnsjlWpbkofpGESIZJ JGmXJfV6vTuZ5ms+rcnp2w8+S8gvZQhDxZb01U+N8U+3EOYGkRi0K2P9hb4SboXg pUSGYa6twbQDm5XzReVEipAuqGSyH22agCckGAiZmluz3iikgQF+GYfa/n/XQirB zq5GGYyiZOvkcVg5pQWGgzcj7KZxDvnvyAY2N+SaN2ohqWYMKgN+Z8pyc3TSHd7G 3NqWZ6BmNJo6A24xn72fmdJJcvHlbw698KgcHgTTBeQjs5ImIJc= =r4OE -----END PGP SIGNATURE-----