Security advisories: Drupal core – Critical – Third Party Libraries – SA-CORE-2019-001

Project: 
Date: 
2019-January-16
Vulnerability: 
Third Party Libraries
Description: 

Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details.

Solution: 
  • If you are using Drupal 8.6.x, upgrade to Drupal 8.6.6.
  • If you are using Drupal 8.5.x or earlier, upgrade to Drupal 8.5.9.
  • If you are using Drupal 7.x, upgrade to Drupal 7.62.

Versions of Drupal 8 prior to 8.5.x are end-of-life and do not receive security coverage.

Fixed By: 

Additional information

Note: Going forward, Drupal core will issue individual security advisories for separate vulnerabilities included in the release, rather than lumping “multiple vulnerabilities” into a single advisory. All advisories released today:

Updating to the latest Drupal core release will apply the fixes for all the above advisories.

Security advisories: Drupal core – Critical – Arbitrary PHP code execution – SA-CORE-2019-002

Project: 
Date: 
2019-January-16
Vulnerability: 
Arbitrary PHP code execution
Description: 

A remote code execution vulnerability exists in PHP’s built-in phar stream wrapper when performing file operations on an untrusted phar:// URI.

Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability.

This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.

Solution: 
  • If you are using Drupal 8.6.x, upgrade to Drupal 8.6.6.
  • If you are using Drupal 8.5.x or earlier, upgrade to Drupal 8.5.9.
  • If you are using Drupal 7.x, upgrade to Drupal 7.62.

Versions of Drupal 8 prior to 8.5.x are end-of-life and do not receive security coverage.

.phar added to dangerous extensions list

The .phar file extension has been added to Drupal’s dangerous extensions list, which means that any such file uploaded to a Drupal file field will automatically be converted to a text file (with the .txt extension) to prevent it from being executed. This is similar to how Drupal handles file uploads with a .php extension.

phar:// stream wrapper disabled by default for Drupal 7 sites on PHP 5.3.2 and earlier

The replacement stream wrapper is not compatible with PHP versions lower than 5.3.3. Drupal 8 requires a higher PHP version than that, but for Drupal 7 sites using lower PHP versions, the built-in phar stream wrapper has been disabled rather than replaced. Drupal 7 sites using PHP 5.2 (or PHP 5.3.0-5.3.2) that require phar support will need to re-enable the stream wrapper for it; however, note that re-enabling the stream wrapper will re-enable the insecure PHP behavior on those PHP versions.

It is very uncommon to both be running a PHP version lower than 5.3.3 and to need phar support. If you’re in that situation, consider upgrading your PHP version instead of restoring insecure phar support.

Reported By: 
Fixed By: 

Additional information

Note: Going forward, Drupal core will issue individual security advisories for separate vulnerabilities included in the release, rather than lumping “multiple vulnerabilities” into a single advisory. All advisories released today:

Updating to the latest Drupal core release will apply the fixes for all the above advisories.

OPTASY: How Do You Deal with Duplicate Content in Drupal? 4 Modules to Get this Issue Fixed

How Do You Deal with Duplicate Content in Drupal? 4 Modules to Get this Issue Fixed

How Do You Deal with Duplicate Content in Drupal? 4 Modules to Get this Issue Fixed

adriana.cacoveanu
Wed, 01/16/2019 – 17:08

Accidentally creating duplicate content in Drupal is like… catching a cold: 

It’s as easy as falling off a log.

All it takes is to:
 

  • further submit your valuable content on other websites, as well, and thus challenging Google with 2 or more identical pieces of content
  • move your website from HTTP to HTTPs, but skip some key steps in the process, so that the HTTP version of your Drupal is still there, “lurking in the dark”
  • have printer-friendly versions of your Drupal site and thus dare Google to face another duplicate content “dilemma”
     

So, what are the “lifebelts” or prevention tools that Drupal “arms” you with for handling this thorny issue?

Here are the 4 modules to use for boosting your site’s immunity system against duplicate content.

AddWeb Solution: Our dearest, Drupal, turns 18!

We’re all engrossed in the mode of celebration and the festive fly game was on point. In fact, everyone else was too painted in that mood, cheering and celebrating the spirit of flying. But our zest for celebration was a notch hire, for our reason for celebration was doubled. 15th January is not merely a date when the kite-flying festival falls but that’s the very day when our dearest of all – Drupal came into existence!

 

Eighteen years before this very day, the very first version of Drupal – 1.0.0 was released by its founder – Dries Buytaert. And just as it happens with all other path-breaking changes world, this one too came with a lot of faith but a humble approach towards its future. And look, how proficiently has it grown in all these years. Today, it’s one of the largest and most-trusted open-source community and the future looks even brighter.  

 

In the age of data-threats, Drupal is trusted for its security, worldwide. Constantly moving towards strengthening the open-source community, Drupal has never compromised on the security, content, and scope. Drupal is also known for its power of personalisation and flexibility. Drupal Commerce is also the preferred one when it comes to building an easy-looking e-commerce platform with complex functionalities. And if that was not enough, the launch of Decoupled Drupal has blown the tech world like a boss!

 

We might sound a little biased here, but we’re speaking nothing but the truth. Everyone from ‘The Beatles’ to ‘Estee Lauder’, ‘Columbia University’, ‘NBC Universal’, ‘NBA’, ‘Paramount’ and many more have trusted and adapted Drupal for years now. Dries has rightly quoted about it in his birthday note for Drupal and let us also conclude, our birthday note for Drupal, on the very same note –

,

         “What do the biggest brands in the world have in common?” – ‘Powered by Drupal!’

 

          Happy 18th birthday to Drupal!

Flocon de toile | Freelance Drupal: Accelerate the site building of a Drupal 8 project

It is not uncommon for a Drupal 8 project, because it has structured content, to develop many content types, each with many fields, which are themselves rendered in a different way through no less than many display modes. One of the consequences is that the design phase known as site building can then become extremely time-consuming. Fortunately, with Drupal 8 we have two modules that allow us to significantly simplify and accelerate this phase.

Dries Buytaert: Happy eighteenth birthday, Drupal

Eighteen years ago today, I released Drupal 1.0.0. What started from humble beginnings has grown into one of the largest Open Source communities in the world. Today, Drupal exists because of its people and the collective effort of thousands of community members. Thank you to everyone who has been and continues to contribute to Drupal.

Eighteen years is also the voting age in the US, and the legal drinking age in Europe. I’m not sure which one is better. 🙂 Joking aside, welcome to adulthood, Drupal. May your day be bug free and filled with fresh patches!

Jacob Rockowitz: The Webform module for Drupal joins Open Collective

Open Source

Open source and me

For the past two years, I have been blogging about my experience building and maintaining the Webform module for Drupal 8 and have had some lively discussions about them all. As the Webform module moved from beta or release candidates, I shared my experience in two posts titled Webform 8.x-5.x: Where Do We Come From? What Are We? Where Are We Going? and Webform, Drupal, and Open Source…Where are we going?. Throughout my blog posts, the question persists…

Open source and organizations

In 2018, open source has become a success story, particularly for large organizations. As someone who has been building websites since Microsoft Internet Explorer 4.0 (1997), I see the fact that Microsoft is going to use the open source Chromium rendering engine as an amazing achievement for open source and even Microsoft. Microsoft has transformed from calling Linux a cancer to fully embracing open source collaboration.

Organizations sponsor open source, however, the work is done by individual developers who may work for an organization or independently within the open source community.

Open source and individuals

I recently wrote about Why I am one of the top contributors to…Read More

Matt Glaman: Come to MidCamp and kick off contribution sprints for DrupalCon Seattle

Come to MidCamp and kick off contribution sprints for DrupalCon Seattle
Monday 14, January 2019
mglaman

MidCamp, the Midwest Drupal Camp, is coming around the corner! March 20th through the 23rd, hundreds of Drupalistas will converge in Chicago for training workshops, contribution sprints, and sessions! This is one of my favorite conferences. The organizers put together so much thought and effort into each detail.