A drupal7 security update has been released for Debian GNU/Linux 9 LTS to address a vulnerability in the version of the Archive_Tar library that comes with Drupal.
DLA-2530-1: drupal7 security update
- -----------------------------------------------------------------------
Debian LTS Advisory DLA-2530-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Gunnar Wolf
January 21, 2021 https://wiki.debian.org/LTS
- -----------------------------------------------------------------------
Package : drupal7
Version : 7.52-2+deb9u14
CVE ID : CVE-2020-36193
Drupal identified a vulnerability in the verson of the Archive_Tar
library it bundles (CVE-2020-36193), which allows out-of-path
extraction vulnerabilities, granting it the Drupal Security Advisory
ID SA-CORE-2021-001:
https://www.drupal.org/sa-core-2021-001
For Debian 9 "Stretch", the fix to this issue was backported in
version 7.52-2+deb9u14.
We recommend you upgrade your drupal7 package.
For detailed security status of drupal7, please refer to its security
tracker page:
https://security-tracker.debian.org/tracker/source-package/drupal7
Further information about Debian LTS security advisories, how to
apply these updates to your system, and other frequently asked
questions can be found at:
https://wiki.debian.org/LTS