<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <p><br>
    </p>
    <div class="moz-forward-container"><br>
      <br>
      -------- Mensagem encaminhada --------
      <table class="moz-email-headers-table" cellpadding="0"
        cellspacing="0" border="0">
        <tbody>
          <tr>
            <th align="RIGHT" nowrap="nowrap" valign="BASELINE">Assunto:
            </th>
            <td>[Security-news] Drupal Core - Critical - Access Bypass -
              SA-CORE-2017-002</td>
          </tr>
          <tr>
            <th align="RIGHT" nowrap="nowrap" valign="BASELINE">Data: </th>
            <td>Wed, 19 Apr 2017 17:59:35 +0000 (UTC)</td>
          </tr>
          <tr>
            <th align="RIGHT" nowrap="nowrap" valign="BASELINE">De: </th>
            <td><a class="moz-txt-link-abbreviated" href="mailto:security-news@drupal.org">security-news@drupal.org</a></td>
          </tr>
          <tr>
            <th align="RIGHT" nowrap="nowrap" valign="BASELINE">Responder
              a: </th>
            <td><a class="moz-txt-link-abbreviated" href="mailto:noreply@drupal.org">noreply@drupal.org</a></td>
          </tr>
          <tr>
            <th align="RIGHT" nowrap="nowrap" valign="BASELINE">Para: </th>
            <td><a class="moz-txt-link-abbreviated" href="mailto:security-news@drupal.org">security-news@drupal.org</a></td>
          </tr>
        </tbody>
      </table>
      <br>
      <br>
      <pre>View online: <a class="moz-txt-link-freetext" href="https://www.drupal.org/SA-CORE-2017-002">https://www.drupal.org/SA-CORE-2017-002</a>

   * Advisory ID: DRUPAL-SA-CORE-2017-002
   * Project: Drupal core [1]
   * Version: 8.x
   * Date: 2017-April-19
   * CVEID: CVE-2017-6919
   * Security risk: 17/25 ( Critical)
     AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Default [2]
   * Vulnerability: Access bypass

-------- DESCRIPTION
---------------------------------------------------------

This is a critical access bypass vulnerability. A site is only affected by
this is the following conditions are met:

   * The site has the RESTful Web Services (rest) module enabled.
   * The site allows PATCH requests.
   * An attacker can get or register a user account on the site.

While we don't normally provide security releases for unsupported minor
releases [3], given the potential severity of this issue, we have also
provided an 8.2.x release to ensure that sites that have not had a chance to
update to 8.3.0 can update safely.


-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [4] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

   * Drupal 8 prior to 8.2.8 and 8.3.1.
   * Drupal 7.x is not affected.

-------- SOLUTION
------------------------------------------------------------

   * If the site is running Drupal 8.2.7 or earlier, upgrade to 8.2.8. [5]
   * If the site is running Drupal 8.3.0, upgrade to 8.3.1. [6]

Also see the Drupal core [7] project page.

-------- REPORTED BY
---------------------------------------------------------

   * Samuel Mortenson [8]

-------- FIXED BY
------------------------------------------------------------

   * Alex Pott [9] of the Drupal Security Team
   * xjm [10] of the Drupal Security Team
   * Lee Rowlands [11] of the Drupal Security Team
   * Wim Leers [12]
   * Sascha Grossenbacher [13]
   * Daniel Wehner [14]
   * Tobias Stöckler [15]
   * Nathaniel Catchpole [16] of the Drupal Security Team

-------- COORDINATED BY
------------------------------------------------------

   * The Drupal Security team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at <a class="moz-txt-link-freetext" href="https://www.drupal.org/contact">https://www.drupal.org/contact</a> [17].

Learn more about the Drupal Security team and their policies [18], writing
secure code for Drupal [19], and  securing your site [20].

Follow the Drupal Security Team on Twitter at
<a class="moz-txt-link-freetext" href="https://twitter.com/drupalsecurity">https://twitter.com/drupalsecurity</a> [21]


[1] <a class="moz-txt-link-freetext" href="https://www.drupal.org/project/drupal">https://www.drupal.org/project/drupal</a>
[2] <a class="moz-txt-link-freetext" href="https://www.drupal.org/security-team/risk-levels">https://www.drupal.org/security-team/risk-levels</a>
[3] <a class="moz-txt-link-freetext" href="https://www.drupal.org/core/release-cycle-overview">https://www.drupal.org/core/release-cycle-overview</a>
[4] <a class="moz-txt-link-freetext" href="http://cve.mitre.org/">http://cve.mitre.org/</a>
[5] <a class="moz-txt-link-freetext" href="https://www.drupal.org/project/drupal/releases/8.2.8">https://www.drupal.org/project/drupal/releases/8.2.8</a>
[6] <a class="moz-txt-link-freetext" href="https://www.drupal.org/project/drupal/releases/8.3.1">https://www.drupal.org/project/drupal/releases/8.3.1</a>
[7] <a class="moz-txt-link-freetext" href="https://www.drupal.org/project/drupal">https://www.drupal.org/project/drupal</a>
[8] <a class="moz-txt-link-freetext" href="https://www.drupal.org/u/samuelmortenson">https://www.drupal.org/u/samuelmortenson</a>
[9] <a class="moz-txt-link-freetext" href="https://www.drupal.org/u/alexpott">https://www.drupal.org/u/alexpott</a>
[10] <a class="moz-txt-link-freetext" href="https://www.drupal.org/u/xjm">https://www.drupal.org/u/xjm</a>
[11] <a class="moz-txt-link-freetext" href="https://www.drupal.org/u/larowlan">https://www.drupal.org/u/larowlan</a>
[12] <a class="moz-txt-link-freetext" href="https://www.drupal.org/u/wim-leers">https://www.drupal.org/u/wim-leers</a>
[13] <a class="moz-txt-link-freetext" href="https://www.drupal.org/u/Berdir">https://www.drupal.org/u/Berdir</a>
[14] <a class="moz-txt-link-freetext" href="https://www.drupal.org/u/dawehner">https://www.drupal.org/u/dawehner</a>
[15] <a class="moz-txt-link-freetext" href="https://www.drupal.org/u/tstoeckler">https://www.drupal.org/u/tstoeckler</a>
[16] <a class="moz-txt-link-freetext" href="https://www.drupal.org/u/catch">https://www.drupal.org/u/catch</a>
[17] <a class="moz-txt-link-freetext" href="https://www.drupal.org/contact">https://www.drupal.org/contact</a>
[18] <a class="moz-txt-link-freetext" href="https://www.drupal.org/security-team">https://www.drupal.org/security-team</a>
[19] <a class="moz-txt-link-freetext" href="https://www.drupal.org/writing-secure-code">https://www.drupal.org/writing-secure-code</a>
[20] <a class="moz-txt-link-freetext" href="https://www.drupal.org/security/secure-configuration">https://www.drupal.org/security/secure-configuration</a>
[21] <a class="moz-txt-link-freetext" href="https://twitter.com/drupalsecurity">https://twitter.com/drupalsecurity</a>

_______________________________________________
Security-news mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Security-news@drupal.org">Security-news@drupal.org</a>
Unsubscribe at <a class="moz-txt-link-freetext" href="https://lists.drupal.org/mailman/listinfo/security-news">https://lists.drupal.org/mailman/listinfo/security-news</a>
</pre>
    </div>
  </body>
</html>