{"id":3088,"date":"2017-06-27T13:40:15","date_gmt":"2017-06-27T20:40:15","guid":{"rendered":"https:\/\/zed.inguardians.com\/?p=3088"},"modified":"2019-08-19T13:41:55","modified_gmt":"2019-08-19T20:41:55","slug":"three-drupal-updates-patch-critical-vulnerabilities","status":"publish","type":"post","link":"https:\/\/zed.inguardians.com\/brief\/three-drupal-updates-patch-critical-vulnerabilities\/","title":{"rendered":"Three Drupal Updates Patch Critical Vulnerabilities"},"content":{"rendered":"
\u00a0Three Drupal updates patch critical vulnerabilities<\/h5>\n
\n
\n

Issue<\/strong>
\nOne of the three critical vulnerabilities patched last week in the Drupal web content management system allows for remote code execution.<\/p>\n

Impact<\/strong>
\nDrupal is one of the most popular content management systems in use, and the vulnerability described in\u00a0CVE-2017-6920 gives an attacker the same capabilities on the system as Drupal itself.
\nThis vulnerability is in the PECL YAML parser and is related to a bug found recently in PHP. \u00a0PHP updated their documentation alerting developers to not pass unsanitized user input to these functions, which did not \u201cfix\u201d the vulnerability.
\nDrupal updated their code, changing the way they pass input to the affected functions and is no longer vulnerable to this attack vector.
\nYAML parsing vulnerabilities have led to quick widespread exploitation in the past, in multiple web frameworks and languages, and are thus considered quite dangerous.<\/p>\n

Recommendations<\/strong>
\nRecent high profile website hack and defacements emphasize the need to check your content management system implementation and ensure it is up to date.<\/p>\n<\/div>\n