backport security fixes from 6.19 and 5.23

[matthewcford]

Binary package hint: drupal6

It seems that there is another security path for drupal to version 6.16

[Marc Deslauriers (mdeslaur)]

Confirmed:

http://drupal.org/node/731710

[Artur Rona (ari-tczew)]

Next time please subscribe motu-swat as team enlightened to fixing universe issues.

I'm on it. I'll fix it at the latest in may.

[Jamie Strandboge (jdstrand)]

Lucid now has 6.16-1.

[Artur Rona (ari-tczew)]

Jaunty is End Of Life.

[Artur Rona (ari-tczew)]

Sending patches to Bazaar was a bad idea. Bzr damages patches. I'm attaching debdiffs.

[Artur Rona (ari-tczew)]

Reopening as lucid is affected by new issue for which I attached a fix.

[Jamie Strandboge (jdstrand)]

New issue is http://drupal.org/node/880476

[Jamie Strandboge (jdstrand)]

Thanks for the debdiffs! The karmic and lucid drupal6 debdiffs are missing a portion of the openid patch to fix SA-CORE-2010-002. This also have an unconventional debian/changelog. Please adjust these and attach new patches to this bug, setting the status to 'New' for these tasks. Thanks!

The hardy SA-CORE-2010-001 patch has an unnecessary whitespace change that deviates from SA-CORE-2010-001-5.21.patch provided by upstream. I have adjusted this for future maintenance. Please be careful to not introduce extra changes when preparing debdiffs/uploads.

Finally, what testing has been performed on these packages?

[Jamie Strandboge (jdstrand)]

Actually, I mispoke on the hardy debdiff (sorry about that)-- the whitespace change was needed to apply the patch.

Uploaded drupal5 for hardy and karmic to the security PPA. Please give feedback on the testing performed.

[Artur Rona (ari-tczew)]

Drupal5 works fine. About drupal6 - I don't know about which module you are talking about. I applied patches which sent to me upstream developer. Nothing else is necessary.

[Steve Beattie (sbeattie)]

The drupal5 packages were mistakenly uploaded to the private security ppa; I copied them over to the public security-proposed ppa at https://launchpad.net/~ubuntu-security-proposed/+archive/ppa/ ; please test and report feedback here.

For the drupal6 debdiffs, I examined the patch to fix SA-CORE-2010-002; the only difference that I could see between it and the upstream commit at http://git.drupalfr.org/cgi-bin/gitweb.cgi?p=core/new-date.git;a=commitdiff;h=d9e273d82fd427115642f2e6c2fbefcb661a2115 was that the dpatch had dropped the changelog entry, VCS tag id updates, and a gratuitous whitespace change -- I do find it's helpful for reviewers when I adjust patches like that to add a note in the patch header that I've done so.

I adjusted the debian/changelog entries to give a better description of the issues and uploaded the packages to the security proposed ppa, again at https://launchpad.net/~ubuntu-security-proposed/+archive/ppa/ ; please test and report feedback here.

Thanks again!

[Steve Beattie (sbeattie)]

After being prompted by Jamie on IRC, I reexamined the differences between the upstream commit and the supplied patch for the openid issue, and the patch in the debdiff is missing the following chunk:

@@ -111,7 +111,7 @@ function openid_form_alter(&$form, $form_state, $form_id) {
       '#weight' => -1,
       '#description' => l(t('What is OpenID?'), 'http://openid.net/', array('external' => TRUE)),
     );
- $form['openid.return_to'] = array('#type' => 'hidden', '#value' => url('openid/authenticate', array('absolute' => TRUE, 'query' => user_login_destination())));
+ $form['openid.return_to'] = array('#type' => 'hidden', '#value' => url('openid/authenticate', array('absolute' => TRUE, 'query' => drupal_get_destination())));
   }
   elseif ($form_id == 'user_register' && isset($_SESSION['openid']['values'])) {
     // We were unable to auto-register a new user. Prefill the registration

[Steve Beattie (sbeattie)]

Ah, the reason it's missing is because it appears that it's a reversion of the first half of this commit: http://git.drupalfr.org/cgi-bin/gitweb.cgi?p=core/new-date.git;a=commitdiff;h=911582f48961b628e02e8af9899e01885b618e1b ; the line in question in 6.16-1 and 6.12-1.1ubuntu1.1 is already in the post-modified form ('query' already points to drupal_get_destination()), and thus the chunk is unnecessary.

[Kees Cook (kees)]

Pocket copied drupal5 and drupal6 to -proposed. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Thank you in advance!

[Kees Cook (kees)]

To ubuntu-sru: if this passes the verification process, please also pocket copy to security. Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package drupal5 - 5.7-1ubuntu1.3

---------------
drupal5 (5.7-1ubuntu1.3) hardy-security; urgency=low

  * SECURITY UPDATE: Multiple vulnerabilities and weaknesses were
    discovered in Drupal (LP: #539056).
    - CVE-2010-3092
    - CVE-2010-3093
    - SA-CORE-2010-001
    - SA-CORE-2010-002
 -- Artur Rona <email address hidden> Mon, 27 Dec 2010 22:35:21 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package drupal5 - 5.18-1.1ubuntu2.2

---------------
drupal5 (5.18-1.1ubuntu2.2) karmic-security; urgency=low

  * SECURITY UPDATE: Multiple vulnerabilities and weaknesses were
    discovered in Drupal (LP: #539056).
    - CVE-2010-3092
    - CVE-2010-3093
    - SA-CORE-2010-001
    - SA-CORE-2010-002
 -- Artur Rona <email address hidden> Mon, 27 Dec 2010 21:57:05 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package drupal6 - 6.12-1.1ubuntu1.2

---------------
drupal6 (6.12-1.1ubuntu1.2) karmic-security; urgency=low

  * SECURITY UPDATE: Multiple vulnerabilities and weaknesses
    (OpenID authentication bypass, file download access bypass,
    comment unpublishing bypass, and actions cross site scripting)
    were discovered in Drupal. (LP: #539056)
    - debian/patches/21_SA-CORE-2010-002.dpatch
    - CVE-2010-3685
    - CVE-2010-3686
    - SA-CORE-2010-002
  * SECURITY UPDATE: Multiple vulnerabilities and weaknesses
    (installation cross site scripting, open redirection, locale
    module cross site scripting and blocked user session regeneration)
    were discovered in Drupal. (LP: #539056)
    - debian/patches/21_SA-CORE-2010-002.dpatch
    - CVE-2010-3091
    - CVE-2010-3092
    - CVE-2010-3093
    - CVE-2010-3094
    - SA-CORE-2010-001
 -- Artur Rona <email address hidden> Tue, 28 Dec 2010 01:56:09 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package drupal6 - 6.16-1ubuntu0.1

---------------
drupal6 (6.16-1ubuntu0.1) lucid-security; urgency=low

  * SECURITY UPDATE: Multiple vulnerabilities and weaknesses
    (OpenID authentication bypass, file download access bypass,
    comment unpublishing bypass, and actions cross site scripting)
    were discovered in Drupal. (LP: #539056)
    - debian/patches/21_SA-CORE-2010-002.dpatch
    - CVE-2010-3685
    - CVE-2010-3686
    - SA-CORE-2010-002
 -- Artur Rona <email address hidden> Tue, 28 Dec 2010 01:23:57 +0100