Drupal 6.14 released to fix multiple critical security vulnerabilities

[Scott Testerman]

Binary package hint: drupal6

Drupal 6.14 has been released to fix multiple critical security vulnerabilities, as well as other, smaller issues. No new functionality has been included. Full details about the security issues addressed by this bugfix are available at http://drupal.org/node/579482 . The release announcement can be found at http://drupal.org/drupal-6.14 .

Drupal 6.14 is not yet available upstream for merging.

Vulnerabilities fixed are:
* OpenID association cross site request forgery vulnerability;
* OpenID impersonation vulnerability;
* File upload creates files that are executable by Apache vulnerability.

New upstream (non-Debian) version:
ftp://ftp.osuosl.org/pub/drupal/files/projects/drupal-6.14.tar.gz

[Scott Testerman (scott-testerman)]

Diff attached for Jaunty

[Scott Testerman (scott-testerman)]

Diff attached for Karmic

[Jamie Strandboge (jdstrand)]

Thank you for using Ubuntu and taking the time to report a bug. This package is in universe and is community supported. I see that you have attached patches to update the Ubuntu packages to the new upstream version. While this work is appreciated, we cannot publish your patches because this does not follow Ubuntu's policy of backporting security patches. If you are able, perhaps you could prepare debdiffs to fix this by following https://wiki.ubuntu.com/SecurityUpdateProcedures.

[Scott Testerman (scott-testerman)]

Drupal6 debdiffs dutifully done.

Please note that these are likely larger than the normal patch, in order to comply with Drupal-supported upgrade methods.

I apologize for not following proper procedure earlier. Please don't dispatch me to the outer circles of Vista.

[Jamie Strandboge (jdstrand)]

Thanks for the debdiffs Scott! What testing was performed for each of these? Please see https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Testing for details.

[Kees Cook (kees)]

I'm afraid these debdiffs are not minimal changes -- we don't normally do full version upgrades; we cherry-pick fixes from upstream and apply those to the existing stable releases.

[Blastoff (wolph)]

As Scott mentioned, "No new functionality has been included." It's a minor version upgrade, not a full version upgrade, and it would be much better than having vulnerable software available in the repositories.