Bug 741392

Summary:	CVE-2011-3730 drupal7: installation path disclosure via a direct request to a .php file [epel-6]
Product:	[Fedora] Fedora EPEL	Reporter:	Vincent Danen <vdanen>
Component:	drupal7	Assignee:	Gwyn Ciesla <gwync>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	low	Docs Contact:
Priority:	low
Version:	el6	CC:	Brandon.Vincent, gwync, stickster
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	fst_owner=bvincent
Fixed In Version:		Doc Type:	Release Note
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-30 05:23:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	741389

Description Vincent Danen 2011-09-26 17:55:10 UTC

epel-6 tracking bug for drupal7: see blocks bug list for full details of the security issue(s).

This bug is never intended to be made public, please put any public notes
in the 'blocks' bugs.


[bug automatically created by: add-tracking-bugs]

Comment 1 Brandon Vincent 2014-10-30 05:23:22 UTC

The general consensus from the discussion of this issue in bug 741389 was that with PHP display_errors turned off (which is set by default) that this is not a security issue.

Per the PHP documentation, "This [display_errors] is a feature to support your development and should never be used on production systems (e.g. systems connected to the internet)."