[Security-news] Drupal Core - Highly Critical - Injection - SA-CORE-2016-003

[security-news at drupal.org]

View online: https://www.drupal.org/SA-CORE-2016-003

   * Advisory ID: DRUPAL-SA-2016-002
   * Project: Drupal core [1]
   * Version: 8.x
   * Date: 2016-July-18
   * Security risk: 20/25 ( Highly Critical)
     AC:Basic/A:None/CI:All/II:All/E:Proof/TD:Default [2]
   * Vulnerability: Injection

-------- DESCRIPTION
---------------------------------------------------------

Drupal 8 uses the third-party PHP library Guzzle for making server-side HTTP
requests. An attacker can provide a proxy server that Guzzle will use. The
details of this are explained at https://httpoxy.org/ [3].


-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [4] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

   * Drupal core 8.x versions prior to 8.1.7

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

   * If you use Drupal 8.x, upgrade to Drupal core 8.1.7 [5]
   * If you use Drupal 7.x, Drupal core is not affected.  However you should
     consider using the mitigation steps at https://httpoxy.org/ [6] since you
     might have modules or other software on your server affected by this
     issue.  For example, sites using Apache can add the following code to
     .htaccess:



        RequestHeader unset Proxy

We also suggest mitigating it as described here: https://httpoxy.org/ [7]

Also see the Drupal core [8] project page.

-------- WHAT IF I AM RUNNING DRUPAL CORE 8.0.X?
-----------------------------

Drupal core 8.0.x is no longer supported. Update to 8.1.7 to get the latest
security and bug fixes.

-------- WHY IS THIS BEING RELEASED MONDAY RATHER THAN WEDNESDAY?
------------

The Drupal Security Team usually releases Security Advisories on Wednesdays.
However, this vulnerability affects more than Drupal, and the authors of
Guzzle and reporters of the issue coordinated to make it public Monday.
Therefore, we are issuing a core release to update to the secure version of
Guzzle today.

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at https://www.drupal.org/contact [9].

Learn more about the Drupal Security team and their policies [10], writing
secure code for Drupal [11], and  securing your site [12].

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [13]


[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3] https://httpoxy.org/
[4] http://cve.mitre.org/
[5] https://www.drupal.org/project/drupal/releases/8.1.7
[6] https://httpoxy.org/
[7] https://httpoxy.org/
[8] https://www.drupal.org/project/drupal
[9] https://www.drupal.org/contact
[10] https://www.drupal.org/security-team
[11] https://www.drupal.org/writing-secure-code
[12] https://www.drupal.org/security/secure-configuration
[13] https://twitter.com/drupalsecurity