Description
A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Drupal | Drupal Core | 8.2.x versions before 8.2.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | drupal7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | drupal7 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.0, < 8.2.7 | 8.2.7 | GHSA-rhx9-3qf7-r3j7 |
| Packagist | drupal/drupal | >= 8.0, < 8.2.7 | 8.2.7 | GHSA-rhx9-3qf7-r3j7 |
References
- 1038058 vdb-entry
- https://www.drupal.org/SA-2017-001
- 96919 vdb-entry