Drupal Releases Out-Of-Band Security Updates

Drupal has released out-of-band security updates to address a vulnerability in Drupal 9

Threat ID:: CC-4062
Threat Severity:: Information only
Published:: 23 March 2022 11:31 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Drupal has released out-of-band security updates to address a vulnerability in Drupal 9

Affected platforms

The following platforms are known to be affected:

Versions: 9.3.x prior to 9.3.9, 9.2.x prior to 9.2.16

Drupal 9

Threat details

Introduction

Drupal has released out-of-band security updates to address a vulnerability in the third-party Guzzle library for handling HTTP requests and responses to external services. The vulnerability, tracked as CVE-2022-24775, relates to improper header parsing in the HTTP message library, guzzlehttp/psr7, which can allow untrusted values to be passed. An attacker could exploit this vulnerability to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review Drupal Security Advisories SA-CORE-2022-006 and apply the necessary updates.

Definitive source of threat updates

https://www.drupal.org/sa-core-2022-006

CVE Vulnerabilities

Status Published

CVE-2022-24775

guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.

Last edited: 23 March 2022 12:23 pm