Bug 1153402 (CVE-2014-3704) - CVE-2014-3704 drupal7: SQL injection leading to code execution and privilege escalation (SA-CORE-2014-005)
Summary: CVE-2014-3704 drupal7: SQL injection leading to code execution and privilege ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-3704
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1153403 1153404
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-10-16 02:07 UTC by Murray McAllister
Modified: 2021-02-04 00:49 UTC (History)
8 users (show)

Fixed In Version: drupal 7.32
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-11-24 05:36:57 UTC
Embargoed:

Attachments (Terms of Use)

Description Murray McAllister 2014-10-16 02:07:49 UTC 
Stefan Horst discovered a pre-authenticated SQL injection flaw in Drupal. This could lead to code execution and privilege escalation.

Upstream patch:

https://www.drupal.org/files/issues/SA-CORE-2014-005-D7.patch

This issue has been fixed in Drupal 7.32. Version 7.32 is an updates candidate in Fedora and EPEL.

References:
https://www.drupal.org/SA-CORE-2014-005
http://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html
Comment 1 Murray McAllister 2014-10-16 02:08:32 UTC 
Created drupal7 tracking bugs for this issue:

Affects: fedora-all [bug 1153403]
Affects: epel-all [bug 1153404]
Comment 3 Fedora Update System 2014-10-28 06:38:21 UTC 
drupal7-7.32-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2014-10-28 06:48:21 UTC 
drupal7-7.32-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2014-11-01 17:17:22 UTC 
drupal7-7.32-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2014-11-01 22:32:06 UTC 
drupal7-7.32-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2014-11-01 22:32:31 UTC 
drupal7-7.32-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Shawn Iwinski 2014-11-22 16:28:12 UTC 
All dependent bugs have been closed and all dists have drupal7-7.32 in stable.  Can this bug be closed?
Comment 9 Murray McAllister 2014-11-24 05:36:57 UTC 
(In reply to Shawn Iwinski from comment #8)
> All dependent bugs have been closed and all dists have drupal7-7.32 in
> stable.  Can this bug be closed?

Yes, sorry for leaving it open!
Note You need to log in before you can comment on or make changes to this bug.