Bug 1572099 (CVE-2018-7602) - CVE-2018-7602 drupal: Remote code execution vulnerability SA-CORE-2018-004
Summary: CVE-2018-7602 drupal: Remote code execution vulnerability SA-CORE-2018-004
Status: CLOSED ERRATA
Alias: CVE-2018-7602
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=critical,public=20180425,repor...
Keywords: Security
Depends On: 1572100 1572101 1572102 1572373
Blocks: 1572103
TreeView+ depends on / blocked
 
Reported: 2018-04-26 08:03 UTC by Adam Mariš
Modified: 2019-06-08 22:50 UTC (History)
9 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2018-08-13 06:54:43 UTC


Attachments (Terms of Use)

Description Adam Mariš 2018-04-26 08:03:04 UTC
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised.

Upstream patches:

Drupal 8.x: https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=bb6d396609600d1169da29456ba3db59abae4b7e
Drupal 7.x: https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=080daa38f265ea28444c540832509a48861587d0

External References:

https://www.drupal.org/sa-core-2018-004

Comment 1 Adam Mariš 2018-04-26 08:03:32 UTC
Created drupal8 tracking bugs for this issue:

Affects: fedora-all [bug 1572101]


Created drupal7 tracking bugs for this issue:

Affects: fedora-all [bug 1572100]
Affects: epel-all [bug 1572102]

Comment 3 Shawn Iwinski 2018-08-11 04:39:07 UTC
All dependent bugs are closed.  Please close this one out.

Comment 4 Adam Mariš 2018-08-13 06:54:43 UTC
(In reply to Shawn Iwinski from comment #3)
> All dependent bugs are closed.  Please close this one out.

OK, thanks!


Note You need to log in before you can comment on or make changes to this bug.