Drupal security updates 7.82, 8.9.17, 9.1.11, and 9.2.2 released with Archive_Tar library updates

Published On22 Jul 2021

Drupal SA-CORE-2021-004

Drupal, a popular Content Management Software written in PHP, has released security updates that prevents a symlink path traversal vulnerability in one of its bundled dependencies.

Drupal depends on Archive_Tar PHP library to decompress Tar files. Drupal uses Tar-compressed files when it downloads module/theme updates, and allows site administrators to upload modules and themes from the Drupal administration panel.

The upstream Archive_Tar library released a security release 1.4.14, which fixes a symlink path traversal vulnerability. Because Drupal bundles Archive_Tar library, Drupal also released a series of new security releases for all its supports branches containing the updated Archive_Tar library.

Released Security Fixes

Following Drupal versions contain fixes for the vulnerability:

All other version series, such as Drupal 8.x series prior to 8.9 are not covered under Drupal security coverage, and will not receive updates.

All Drupal 7.x, 8.x, and 9.x sites are strongly suggested to update to the latest Drupal version.

Mitigation Factors

The symlink path traversal vulnerability is not exploitable from the way Drupal core uses the Archive_Tar library. However, a maliciously created .tar.gz, .tar, etc. file could exploit the vulnerability if it was uploaded to a Drupal form that extracts such files using the Archive_Tar library.

In other news on PHP.Watch

All News • Feed
PHP 8.4 Feature-freeze, first Release Candidate released

PHP 8.4 Feature-freeze, first Release Candidate released

The first release candidate of the upcoming PHP 8.4 is now out. PHP8.4-RC1 previews all new features, changes, and deprecations available on PHP 8.4, and can be used to test the compatibility of applications with PHP 8.4.
PHP Release Cycle Update

PHP Release Cycle Update

The PHP release cycle changes to extend the active support for all current and future PHP versions from one year to two years, and to align the support timelines to the end of the calendar year.
PHP 8.3 Released!

PHP 8.3 Released!

PHP 8.3 was released today, containing over 1,000 commits from over 100 contributors.
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.

Support PHP.Watch — If you find the articles, version information, Codex, and other PHP.Watch contributions useful, consider supporting through GitHub Sponsors. Your sponsorship helps dedicate more time to creating valuable content and improving the PHP community. Together, we can keep the momentum going — thank you for your support!

Thanks to the highest tier sponsor: @TomasVotruba for your generous support to keep PHP.Watch moving 💜