<div dir="ltr"><br><div class="gmail_quote">View online: <a href="https://www.drupal.org/sa-core-2020-012" rel="noreferrer" target="_blank">https://www.drupal.org/sa-core-2020-012</a><br>
<br>
Project: Drupal core [1]<br>
Date: 2020-November-18<br>
Security risk: *Critical* 17∕25<br>
AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Default [2]<br>
Vulnerability: Remote code execution<br>
<br>
CVE IDs: CVE-2020-13671<br>
Description: <br>
Drupal core does not properly sanitize certain filenames on uploaded files,<br>
which can lead to files being interpreted as the incorrect extension and<br>
served as the wrong MIME type or executed as PHP for certain hosting<br>
configurations.<br>
<br>
Solution: <br>
Install the latest version:<br>
<br>
* If you are using Drupal 9.0, update to Drupal 9.0.8 [3]<br>
* If you are using Drupal 8.9, update to Drupal 8.9.9 [4]<br>
* If you are using Drupal 8.8 or earlier, update to Drupal 8.8.11 [5]<br>
* If you are using Drupal 7, update to Drupal 7.74 [6]<br>
<br>
Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive<br>
security coverage.<br>
<br>
Additionally, it's recommended that you audit all previously uploaded files<br>
to check for malicious extensions. Look specifically for files that include<br>
more than one extension, like .php.txt or .html.gif.<br>
<br>
Reported By: <br>
* ufku [7]<br>
* Mark Ferree [8]<br>
* Frédéric G. Marand [9]<br>
* Samuel Mortenson [10] of the Drupal Security Team<br>
* Derek Wright [11]<br>
<br>
Fixed By: <br>
* Heine [12] of the Drupal Security Team<br>
* ufku [13]<br>
* Mark Ferree [14]<br>
* Michael Hess [15] of the Drupal Security Team<br>
* David Rothstein [16] of the Drupal Security Team<br>
* Peter Wolanin [17] of the Drupal Security Team<br>
* Jess [18] of the Drupal Security Team<br>
* Frédéric G. Marand [19]<br>
* Stefan Ruijsenaars [20]<br>
* David Snopek [21] of the Drupal Security Team<br>
* Rick Manelius [22]<br>
* David Strauss [23] of the Drupal Security Team<br>
* Samuel Mortenson [24] of the Drupal Security Team<br>
* Ted Bowman [25]<br>
* Alex Pott [26] of the Drupal Security Team<br>
* Derek Wright [27]<br>
* Lee Rowlands [28] of the Drupal Security Team<br>
* Kim Pepper [29]<br>
* Wim Leers [30]<br>
* Nate Lampton [31]<br>
* Drew Webber [32] of the Drupal Security Team<br>
* Fabian Franz [33]<br>
* Alex Bronstein [34] of the Drupal Security Team<br>
* Neil Drumm [35] of the Drupal Security Team<br>
* Joseph Zhao [36]<br>
* Ryan Aslett [37]<br>
<br>
<br>
[1] <a href="https://www.drupal.org/project/drupal" rel="noreferrer" target="_blank">https://www.drupal.org/project/drupal</a><br>
[2] <a href="https://www.drupal.org/security-team/risk-levels" rel="noreferrer" target="_blank">https://www.drupal.org/security-team/risk-levels</a><br>
[3] <a href="https://www.drupal.org/project/drupal/releases/9.0.8" rel="noreferrer" target="_blank">https://www.drupal.org/project/drupal/releases/9.0.8</a><br>
[4] <a href="https://www.drupal.org/project/drupal/releases/8.9.9" rel="noreferrer" target="_blank">https://www.drupal.org/project/drupal/releases/8.9.9</a><br>
[5] <a href="https://www.drupal.org/project/drupal/releases/8.8.11" rel="noreferrer" target="_blank">https://www.drupal.org/project/drupal/releases/8.8.11</a><br>
[6] <a href="https://www.drupal.org/project/drupal/releases/7.74" rel="noreferrer" target="_blank">https://www.drupal.org/project/drupal/releases/7.74</a><br>
[7] <a href="https://www.drupal.org/user/9910" rel="noreferrer" target="_blank">https://www.drupal.org/user/9910</a><br>
[8] <a href="https://www.drupal.org/user/76245" rel="noreferrer" target="_blank">https://www.drupal.org/user/76245</a><br>
[9] <a href="https://www.drupal.org/user/27985" rel="noreferrer" target="_blank">https://www.drupal.org/user/27985</a><br>
[10] <a href="https://www.drupal.org/user/2582268" rel="noreferrer" target="_blank">https://www.drupal.org/user/2582268</a><br>
[11] <a href="https://www.drupal.org/user/46549" rel="noreferrer" target="_blank">https://www.drupal.org/user/46549</a><br>
[12] <a href="https://www.drupal.org/user/17943" rel="noreferrer" target="_blank">https://www.drupal.org/user/17943</a><br>
[13] <a href="https://www.drupal.org/user/9910" rel="noreferrer" target="_blank">https://www.drupal.org/user/9910</a><br>
[14] <a href="https://www.drupal.org/user/76245" rel="noreferrer" target="_blank">https://www.drupal.org/user/76245</a><br>
[15] <a href="https://www.drupal.org/user/102818" rel="noreferrer" target="_blank">https://www.drupal.org/user/102818</a><br>
[16] <a href="https://www.drupal.org/user/124982" rel="noreferrer" target="_blank">https://www.drupal.org/user/124982</a><br>
[17] <a href="https://www.drupal.org/user/49851" rel="noreferrer" target="_blank">https://www.drupal.org/user/49851</a><br>
[18] <a href="https://www.drupal.org/user/65776" rel="noreferrer" target="_blank">https://www.drupal.org/user/65776</a><br>
[19] <a href="https://www.drupal.org/user/27985" rel="noreferrer" target="_blank">https://www.drupal.org/user/27985</a><br>
[20] <a href="https://www.drupal.org/user/551886" rel="noreferrer" target="_blank">https://www.drupal.org/user/551886</a><br>
[21] <a href="https://www.drupal.org/user/266527" rel="noreferrer" target="_blank">https://www.drupal.org/user/266527</a><br>
[22] <a href="https://www.drupal.org/user/680072" rel="noreferrer" target="_blank">https://www.drupal.org/user/680072</a><br>
[23] <a href="https://www.drupal.org/user/93254" rel="noreferrer" target="_blank">https://www.drupal.org/user/93254</a><br>
[24] <a href="https://www.drupal.org/user/2582268" rel="noreferrer" target="_blank">https://www.drupal.org/user/2582268</a><br>
[25] <a href="https://www.drupal.org/user/240860" rel="noreferrer" target="_blank">https://www.drupal.org/user/240860</a><br>
[26] <a href="https://www.drupal.org/user/157725" rel="noreferrer" target="_blank">https://www.drupal.org/user/157725</a><br>
[27] <a href="https://www.drupal.org/user/46549" rel="noreferrer" target="_blank">https://www.drupal.org/user/46549</a><br>
[28] <a href="https://www.drupal.org/user/395439" rel="noreferrer" target="_blank">https://www.drupal.org/user/395439</a><br>
[29] <a href="https://www.drupal.org/user/370574" rel="noreferrer" target="_blank">https://www.drupal.org/user/370574</a><br>
[30] <a href="https://www.drupal.org/user/99777" rel="noreferrer" target="_blank">https://www.drupal.org/user/99777</a><br>
[31] <a href="https://www.drupal.org/user/35821" rel="noreferrer" target="_blank">https://www.drupal.org/user/35821</a><br>
[32] <a href="https://www.drupal.org/user/255969" rel="noreferrer" target="_blank">https://www.drupal.org/user/255969</a><br>
[33] <a href="https://www.drupal.org/user/693738" rel="noreferrer" target="_blank">https://www.drupal.org/user/693738</a><br>
[34] <a href="https://www.drupal.org/user/78040" rel="noreferrer" target="_blank">https://www.drupal.org/user/78040</a><br>
[35] <a href="https://www.drupal.org/user/3064" rel="noreferrer" target="_blank">https://www.drupal.org/user/3064</a><br>
[36] <a href="https://www.drupal.org/user/1987218" rel="noreferrer" target="_blank">https://www.drupal.org/user/1987218</a><br>
[37] <a href="https://www.drupal.org/user/391689" rel="noreferrer" target="_blank">https://www.drupal.org/user/391689</a><br>
<br>
_______________________________________________<br>
Security-news mailing list<br>
<a href="mailto:Security-news@drupal.org" target="_blank">Security-news@drupal.org</a><br>
Unsubscribe at <a href="https://lists.drupal.org/mailman/listinfo/security-news" rel="noreferrer" target="_blank">https://lists.drupal.org/mailman/listinfo/security-news</a></div><div class="gmail_quote"><br></div><div class="gmail_quote"><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div>===</div><div>Computer Security Incident Response Team - CSIRT</div><div>Universidade Estadual de Campinas - Unicamp</div><div>Centro de Computacao - CCUEC</div><div>GnuPG Public Key: <a href="http://www.security.unicamp.br/security.asc" target="_blank">http://www.security.unicamp.br/security.asc</a> [^]</div><div>Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830</div></div></div></div>
</div></div>