Your message dated Sun, 05 Feb 2012 17:48:07 +0000
with message-id <e1ru6c7-00058l...@franck.debian.org>
and subject line Bug#658337: fixed in drupal7 7.11-1
has caused the Debian Bug report #658337,
regarding [drupal7] DRUPAL-SA-CORE-2012-001 - Security Update for Drupal 6+7
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
658337: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658337
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: drupal7
Version: 7.10-1.1
Severity: critical
Tags: security
X-Debbugs-CC: secure-testing-t...@lists.alioth.debian.org
--- Please enter the report below this line. ---
Hi!
There's a security update on drupal.org for Drupal6 and Drupal7 which
fixes Access Bypass, Cross Site Request Forgery and multiple other
vulnerabilities. Here's the Drupal Security Announcement:
==================
* Advisory ID: DRUPAL-SA-CORE-2012-001
* Project: Drupal core [1]
* Version: 6.x, 7.x
* Date: 2012-February-01
* Security risk: Moderately critical [2]
* Exploitable from: Remote
* Vulnerability: Access bypass, Cross Site Request Forgery, Multiple
vulnerabilities
-------- DESCRIPTION
---------------------------------------------------------
.... Cross Site Request Forgery vulnerability in Aggregator module
CVE: CVE-2012-0826
An XSRF vulnerability can force an aggregator feed to update. Since some
services are rate-limited (e.g. Twitter limits requests to 150 per hour)
this
could lead to a denial of service.
This issue affects Drupal 6.x and 7.x.
.... OpenID not verifying signed attributes in SREG and AX
CVE: CVE-2012-0825
A group of security researchers identified a flaw in how some OpenID relying
parties implement Attribute Exchange (AX). Not verifying that attributes
being passed through AX have been signed could allow an attacker to modify
users' information.
This issue affects Drupal 6.x and 7.x.
.... Access bypass in File module
CVE: CVE-2012-0827
When using private files in combination with certain field access modules,
the File module will allow users to download the file even if they do not
have access to view the field it was attached to.
This issue affects Drupal 7.x only.
-------- VERSIONS AFFECTED
---------------------------------------------------
* Drupal 6.x core prior to 6.23.
* Drupal 7.x core prior to 7.11.
-------- SOLUTION
------------------------------------------------------------
Install the latest version:
* If you use Drupal 6.x upgrade to 6.23 [3]
* If you use Drupal 7.x upgrade to 7.11 [4]
See also the Drupal core [5] project page.
-------- REPORTED BY
---------------------------------------------------------
* The Aggregator module CSRF vulnerability was reported by Dylan Tack
[6] of
the Drupal Security Team.
* The OpenID vulnerability was reported by Rui Wang, Shuo Chen and
Xiao Feng
Wang [7].
* The File module access bypass issue was reported by David Rothstein
[8] of
the Drupal Security Team, and by Sascha Grossenbacher [9].
-------- FIXED BY
------------------------------------------------------------
* Aggregator CSRF issue fixed by Dave Reid [10] of the Drupal
Security Team
* OpenID issue fixed by Vojtech Kusy [11] and Christian Schmidt [12]
* The File module access bypass issue was fixed by David Rothstein
[13] of
the Drupal Security Team, Sascha Grossenbacher [14], and Derek
Wright [15]
of the Drupal Security Team.
-------- CONTACT AND MORE INFORMATION
----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [16].
Learn more about the Drupal Security team and their policies [17], writing
secure code for Drupal [18], and securing your site [19].
[1] http://drupal.org/project/drupal
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/node/1425082
[4] http://drupal.org/node/1425092
[5] http://drupal.org/project/drupal
[6] http://drupal.org/user/96647
[7] http://openid.net/2011/05/05/attribute-exchange-security-alert/
[8] http://drupal.org/user/124982
[9] http://drupal.org/user/214652
[10] http://drupal.org/user/53892
[11] http://drupal.org/user/56154
[12] http://drupal.org/user/216078
[13] http://drupal.org/user/124982
[14] http://drupal.org/user/214652
[15] http://drupal.org/user/46549
[16] http://drupal.org/contact
[17] http://drupal.org/security-team
[18] http://drupal.org/writing-secure-code
[19] http://drupal.org/security/secure-configuration
==================
--- System information. ---
Architecture: amd64
Kernel: Linux 3.1.0-1-amd64
Debian Release: wheezy/sid
500 unstable www.debian-multimedia.org
500 unstable ftp.de.debian.org
--- Package information. ---
Depends (Version) | Installed
====================================-+-============
debconf (>= 0.5) | 1.5.41
OR debconf-2.0 |
apache2 | 2.2.21-5
OR httpd |
php5 | 5.3.9-6
php5-mysql | 5.3.9-6
OR php5-pgsql | 5.3.9-6
php5-gd | 5.3.9-6
default-mta |
OR mail-transport-agent |
wwwconfig-common (>= 0.0.37) | 0.2.2
mysql-client | 5.1.58-1
OR virtual-mysql-client |
OR postgresql-client | 9.1+128
dbconfig-common | 1.8.47+nmu1
curl | 7.24.0-1
Recommends (Version) | Installed
===========================-+-===========
mysql-server |
OR postgresql | 9.1+128
Package's Suggests field is empty.
--
Ciao... // Fon: 0381-2744150
Ingo \X/ http://blog.windfluechter.net
Please don't share this address with Facebook or Google!
gpg pubkey: http://www.juergensmann.de/ij_public_key.asc
--- End Message ---
--- Begin Message ---
Source: drupal7
Source-Version: 7.11-1
We believe that the bug you reported is fixed in the latest version of
drupal7, which is due to be installed in the Debian FTP archive:
drupal7_7.11-1.debian.tar.gz
to main/d/drupal7/drupal7_7.11-1.debian.tar.gz
drupal7_7.11-1.dsc
to main/d/drupal7/drupal7_7.11-1.dsc
drupal7_7.11-1_all.deb
to main/d/drupal7/drupal7_7.11-1_all.deb
drupal7_7.11.orig.tar.gz
to main/d/drupal7/drupal7_7.11.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 658...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Luigi Gangitano <lu...@debian.org> (supplier of updated drupal7 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sun, 05 Feb 2012 18:16:47 +0100
Source: drupal7
Binary: drupal7
Architecture: source all
Version: 7.11-1
Distribution: unstable
Urgency: high
Maintainer: Luigi Gangitano <lu...@debian.org>
Changed-By: Luigi Gangitano <lu...@debian.org>
Description:
drupal7 - fully-featured content management framework
Closes: 658337
Changes:
drupal7 (7.11-1) unstable; urgency=high
.
[ Luigi Gangitano ]
* Urgency high due to security fixes
.
* New upstream release
- Fixes Access bypass, Cross Site Request Forgery, Multiple vulnerabilities
(Ref: SA-CORE-2012-001, CVE-2012-0825, CVE-2012-0826, CVE-2012-0827)
(Closes: #658337)
Checksums-Sha1:
a338e72600a83937ef4d1ecb41e01a7e3c9accbd 1178 drupal7_7.11-1.dsc
5a94916ff5d6624b4872cb4e24de7a561235a415 2789336 drupal7_7.11.orig.tar.gz
fdac2e942dfb87f4b16e35ac947e27a58c936aaf 189557 drupal7_7.11-1.debian.tar.gz
5e7044fe1758f393560217b77996c99dc18480e1 2838194 drupal7_7.11-1_all.deb
Checksums-Sha256:
acd93329b37231c406bc52f4d5380e8d1570ccebe0d6974188956e4d96e60bfd 1178
drupal7_7.11-1.dsc
a9cba1ddc28242f830169d4e287970dfcb3aad0598426fde209b38967b4694f7 2789336
drupal7_7.11.orig.tar.gz
e492b651a32451421112538902b7b0b07f3bc5e38802c8175a3e30f314e331dc 189557
drupal7_7.11-1.debian.tar.gz
61b219fb55d7ed2d18fbdddc4fe5ae79bceb7214084e942273abfd1c94527918 2838194
drupal7_7.11-1_all.deb
Files:
2b9404f840b1730ebf585220f30e8ccb 1178 web extra drupal7_7.11-1.dsc
e9857e1749762367d7631d74cc6564a7 2789336 web extra drupal7_7.11.orig.tar.gz
8376e56326c597b442afe222bf511475 189557 web extra drupal7_7.11-1.debian.tar.gz
f135280b40009c158842856e64aec7b0 2838194 web extra drupal7_7.11-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (Darwin)
iEYEARECAAYFAk8uvZ4ACgkQ8ZumGJJMDCY2EwCfVQgdgT4WZEH/oDT7ivBI/GKo
ulEAn3OltUXIa2QStdwxxEq/NHk4x/8w
=V5yl
-----END PGP SIGNATURE-----
--- End Message ---
