Which Drupal versions are affected by the vulnerabilities in advisory PSA-2016-001?

Question

There is an PSA about the 2016-July-13 Security Advisory of several critical updates:

View online: https://www.drupal.org/node/2764899

• Advisory ID: DRUPAL-PSA-2016-001
• Project: Drupal contributed modules
• Version: 7.x
• Date: 2016-July-12
• Security risk: 22/25 ( Highly Critical)
• AC:None/A:None/CI:All/II:All/E:Theoretical/TD:All 1
• Vulnerability: Arbitrary PHP code execution

DESCRIPTION

There will be multiple releases of Drupal contributed modules on Wednesday July 13th 2016 16:00 UTC that will fix highly critical remote code execution vulnerabilities (risk scores up to 22/25 [2]). The Drupal Security Team urges you to reserve time for module updates at that time because exploits are expected to be developed within hours/days. Release announcements will appear at the standard announcement locations. [3]

Drupal core is not affected. Not all sites will be affected. You should review the published advisories on July 13th 2016 to see if any modules you use are affected.

The advisory only mentions version 7.x as vulnerable, but I realized that I'm not entirely sure how I can interpret that. My interpretation is that Drupal 8.x should not be affected by these issues. But I'm really not sure about Drupal 6.x.

Drupal 6 is no longer supported. Does that mean that this kind of advisory won't even mention if it is still vulnerable? Or can I interpret this one as only version 7 is affected?

Which versions exactly are potentially affected by this advisory?

Answer 1

The security team is intentionally a bit circumspect with these warnings. They either have to catch us all flat-footed or give potential attackers a heads up that something worth their time is coming. Currently they are siding with the latter method (and as much as I hated seeing that message today I agree with them).

For the most part it will not be clear until they release the news what modules will be covered. There is already speculation in some circles, but there isn't likely anything to be done before the announcement. Clearly from their announcement multiple modules are effected, and likely at least one is something very common.

Depending on the number of sites you support you should block off enough time to do updates for all of them.

These advisories will no longer cover Drupal 6. There is no formal way to know if Drupal 6 is effected (there will probably twitter comments, blog posts, etc about it after the release of the updates). If D6 is effected the only solution may be to take them offline.

Answer 2

That security advisory is about third-party modules made for Drupal 7. If also Drupal 8 were affected, then the advisory would report Version: 7.x, 8.x.
It doesn't report if Drupal 6 is affected, since that is a unsupported version, and the Drupal.org security team doesn't fix security issues on unsupported Drupal versions. Probably, once the involved third-party modules get a security release, it will be possible to see the change done in the code, and if the same security issue is present in the equivalent module for Drupal 6, but that will not be covered from any security advisory done from the security team.

Drupal 7 core is not involved, and I take the security team didn't want to reveal the third-party modules affected to avoid some hackers try to attach Drupal sites. When the security team gives those advisories, there is already a new version available that fixed the security issue; probably, since there are more modules involved, they could not be get a new version for all the modules.

Since the advisory doesn't say which modules are affected, it is not possible to say which version.

That advisory seems more a note to let users know new releases are expected in the next days, and avoid that is missed. They are not still giving a list of modules to update; note the following sentence:

Release announcements will appear at the standard announcement locations.

The linked page is for releases containing security fixes, and the most recent one was made on July 6, 2016.