Bug 1572099 (CVE-2018-7602) - CVE-2018-7602 drupal: Remote code execution vulnerability SA-CORE-2018-004
Summary: CVE-2018-7602 drupal: Remote code execution vulnerability SA-CORE-2018-004
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-7602
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1572100 1572101 1572102 1572373
Blocks: 1572103
TreeView+ depends on / blocked
 
Reported: 2018-04-26 08:03 UTC by Adam Mariš
Modified: 2021-02-17 00:24 UTC (History)
9 users (show)

Fixed In Version: drupal 7.59, drupal 8.4.8, drupal 8.5.3
Clone Of:
Environment:
Last Closed: 2018-08-13 06:54:43 UTC
Embargoed:

Attachments (Terms of Use)

Description Adam Mariš 2018-04-26 08:03:04 UTC 
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised.

Upstream patches:

Drupal 8.x: https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=bb6d396609600d1169da29456ba3db59abae4b7e
Drupal 7.x: https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=080daa38f265ea28444c540832509a48861587d0

External References:

https://www.drupal.org/sa-core-2018-004
Comment 1 Adam Mariš 2018-04-26 08:03:32 UTC 
Created drupal8 tracking bugs for this issue:

Affects: fedora-all [bug 1572101]


Created drupal7 tracking bugs for this issue:

Affects: fedora-all [bug 1572100]
Affects: epel-all [bug 1572102]
Comment 3 Shawn Iwinski 2018-08-11 04:39:07 UTC 
All dependent bugs are closed.  Please close this one out.
Comment 4 Adam Mariš 2018-08-13 06:54:43 UTC 
(In reply to Shawn Iwinski from comment #3)
> All dependent bugs are closed.  Please close this one out.

OK, thanks!
Note You need to log in before you can comment on or make changes to this bug.