2 vulnerabilities were reported [1] in Drupal Views module. Open redirect vulnerability The module does not sanitize user provided URLs when processing the page to break the lock on Views being edited, thereby exposing an open redirect attack vector. This vulnerability is mitigated by the fact that the Views UI submodule must be enabled. Access bypass vulnerability The module does not protect the default Views configurations that ship with the module sufficiently, thereby exposing possibly protected information to unprivileged users. This vulnerability is mitigated by the fact that it only affects sites that have not granted the common "access content" or "access comments" permission to untrusted users. Furthermore, these default views configurations are disabled by default and must be enabled by an administrator. CVE request: http://seclists.org/oss-sec/2015/q1/549 [1]: https://www.drupal.org/node/2424403
Created drupal6-views tracking bugs for this issue: Affects: fedora-all [bug 1192960] Affects: epel-all [bug 1192962]
Created drupal7-views tracking bugs for this issue: Affects: fedora-all [bug 1192961] Affects: epel-all [bug 1192963]
Hi! Do I need to edit drupal7-views update to add these BZ issue numbers(1192961, 1192963)? Because I've submitted them before you created these BZ issues. Thanks!
As I can see Jon (limb) has updated drupal6-views as well. https://admin.fedoraproject.org/updates/search/drupal6-views
(In reply to Peter Borsa from comment #4) > Do I need to edit drupal7-views update to add these BZ issue > numbers(1192961, 1192963)? Because I've submitted them before you created > these BZ issues. Peter, for completeness and sanity I would say that it will be good to have both these BZs mentioned in the update.
Done, I've just added those ones. Thank you, Vasyl!
drupal6-views-2.18-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
drupal6-views-2.18-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
Hi Vasyl! Can we close this issue because the updated modules are in stable repositories?
(In reply to Peter Borsa from comment #10) > Hi Vasyl! > > Can we close this issue because the updated modules are in stable > repositories? Hi Peter, Same as bug 1182940, this one affects OpenShift Online which is not yet fixed - this bug should remain open.
Hi, Okay, thank you!