UBUNTU-CVE-2020-13671

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2020-13671

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-13671.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2020-13671

Related

Published

2020-11-20T16:15:00Z

Modified

2024-12-06T04:30:50Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

References

Affected packages

Ubuntu:Pro:14.04:LTS / drupal7

Package

Name: drupal7
Purl: pkg:deb/ubuntu/drupal7?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.26-1ubuntu0.1+esm2

Affected versions

7.*

7.23-1

7.24-1

7.24-2

7.26-1

7.26-1ubuntu0.1

7.26-1ubuntu0.1+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "binary_version": "7.26-1ubuntu0.1+esm2",
            "binary_name": "drupal7"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / drupal7

Package

Name: drupal7
Purl: pkg:deb/ubuntu/drupal7?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.44-1ubuntu1~16.04.0+esm2

Affected versions

7.*

7.38-1

7.41-1

7.44-1ubuntu1~16.04.0

7.44-1ubuntu1~16.04.0+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "binary_version": "7.44-1ubuntu1~16.04.0+esm2",
            "binary_name": "drupal7"
        }
    ]
}