Developer Only Discussion List

[Jeremy Blosser <jblosser-smgl AT firinn.org>]

I need someone to step up and own keeping Drupal updating on
www.sourcemage.org, or it's going to have to come down.  As the guy who
owns the server I cannot allow software to be installed that isn't
maintained against this kind of vulnerability.  I also don't have time or
inclination to do all the updates myself when I've got other stuff I need
to do and the actual value this app provides us right now is so limited.

Those of you want that want to keep Drupal vs. just a wiki, the option is
up to you, right now.  Either one of your volunteers to keep it updated, or
not.

----- Forwarded message from bugzilla-daemon AT bugs.sourcemage.org -----

Date: 19 Mar 2007 19:45:55 -0000
From: bugzilla-daemon AT bugs.sourcemage.org
To: collab AT sourcemage.org
Subject: [Bug 13634]  New: security update for drupal to 4.7.6

http://bugs.sourcemage.org/show_bug.cgi?id=13634

           Summary: security update for drupal to 4.7.6
           Product: Codex
           Version: stable grimoire
          Platform: All
               URL: http://drupal.org/files/sa-2007-005/advisory.txt
        OS/Version: Linux
            Status: NEW
          Severity: blocker
          Priority: P1
         Component: collab
        AssignedTo: collab AT sourcemage.org
        ReportedBy: eric AT sandall.us


From the security advisory in URL:
----------------------------------------------------------------------------
Drupal security advisory                                  DRUPAL-SA-2007-005
----------------------------------------------------------------------------
Project:          Drupal core
Version:          4.7.x, 5.x
Date:             2007-Jan-29 
Security risk:    Highy critical
Exploitable from: Remote
Vulnerability:    Arbitrary code execution
----------------------------------------------------------------------------
 
Description
-----------
Previews on comments were not passed through normal form validation routines,
enabling users with the 'post comments' permission and access to more than one
input filter to execute arbitrary code. By default, anonymous and 
authenticated
users have access to only one input format.

Immediate workarounds include: disabling the comment module, revoking the 
'post 
comments' permission for all users or limiting access to one input format.

Versions affected
-----------------
- Drupal 4.7.x versions before Drupal 4.7.6
- Drupal 5.x versions before Drupal 5.1

We have 4.7.3 in all grimoires.

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

----- End forwarded message -----

Attachment: pgp6P4O3bKZ6r.pgp
Description: PGP signature