Pierluigi Paganini March 23, 2018

Drupal Security Team confirmed that a “highly critical” vulnerability affects Drupal 7 and 8 core and announced the availability of security updates on March 28th.

A “highly critical” vulnerability affects Drupal 7 and 8 core and Drupal developers are currently working to address it.

Drupal maintainers initially planned to issue a security release of Drupal 7.x, 8.3.x, 8.4.x, and 8.5.x on March 28th 2018 between 18:00 – 19:30 UTC.

The security team asked to reserve time for core updates fearing that threat actors could exploit the “highly critical security vulnerability.”

“There will be a security release of Drupal 7.x, 8.3.x, 8.4.x, and 8.5.x on March 28th 2018 between 18:00 – 19:30 UTC, one week from the publication of this document, that will fix a highly critical security vulnerability.” reads the advisory sent to the developers.

“The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days. “

Both Drupal 8.3.x and 8.4.x are not supported, but due to the severity of the flaw the Drupal Security Team decided to address it with specific security updates.

The Drupal CMS currently runs on over one million websites, it is the second most popular content management system behind WordPress.

“While Drupal 8.3.x and 8.4.x are no longer supported and we don’t normally provide security releases for unsupported minor releases, given the potential severity of this issue, we areproviding 8.3.x and 8.4.x releases that include the fix for sites which have not yet had a chance to update to 8.5.0.” continues the advisory.

The Drupal security team strongly recommends the following:

• Sites on 8.3.x should immediately update to the 8.3.x release that will be provided in the advisory, and then plan to update to the latest 8.5.x security release in the next month.
• Sites on 8.4.x should immediately update to the 8.4.x release that will be provided in the advisory, and then plan to update to the latest 8.5.x security release in the next month.
• Sites on 7.x or 8.5.x can immediately update when the advisory is released using the normal procedure.

Pierluigi Paganini

(Security Affairs – Drupal security updates, security)

[adrotate banner=”5″]

[adrotate banner=”13″]