{"id":2532,"date":"2021-01-27T09:10:02","date_gmt":"2021-01-27T14:10:02","guid":{"rendered":"https:\/\/cert.pa\/?p=2532"},"modified":"2021-01-27T09:10:02","modified_gmt":"2021-01-27T14:10:02","slug":"csirt-panama-aviso-2021-25-01-drupal-mitigaciones-obtenidas-de-drupal","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=2532","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2021-25-01 Drupal: Mitigaciones obtenidas de Drupal."},"content":{"rendered":"\n<p>CSIRT Panam\u00e1 Aviso 2021-25-01 Drupal: Mitigaciones obtenidas\nde Drupal.<\/p>\n\n\n\n<p>Gravedad: Alta&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p>Fecha de publicaci\u00f3n: Enero 25,\n2021<br>\n\u00daltima revisi\u00f3n: Enero 25, 2021<br>\nPortal: https:\/\/www.drupal.org\/ <\/p>\n\n\n\n<p>Sistemas Afectados: Vulnerabilidades que afectan a los\nsistemas Drupal que usan librer\u00edas de &nbsp;Archive_Tar.<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Descripci\u00f3n<\/strong><\/li><\/ol>\n\n\n\n<p>Vulnerabilidades que afectan a los sistemas Drupal\nque usan Archive_Tar, en las versiones de la 0.3 a la 1.4.11.<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Impacto<\/strong><\/li><\/ol>\n\n\n\n<p>Vulnerabilidad: CVE-2020-36193<\/p>\n\n\n\n<p>La vulnerabilidad CVE-2020-36193 existe debido a un\nenlace simb\u00f3lico con problemas para acceder al archivo tar.php en Archive_Tar,\nun atacante remoto podr\u00eda entregar un archivo especialmente dise\u00f1ado a la\naplicaci\u00f3n Drupal para forzarla a escribir archivos arbitrarios en el sistema\nutilizando secuencias de directorio transversal.<\/p>\n\n\n\n<p><strong>III. Referencia a soluciones, herramientas e\ninformaci\u00f3n<\/strong><strong><\/strong><\/p>\n\n\n\n<p>Actualizaci\u00f3n de los recursos Drupal el siguiente\nenlace: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Drupal\n9.1, actualizar a Drupal 9.1.3.<\/li><li>Drupal\n9.0, actualizar a Drupal 9.0.11.<\/li><li>Drupal\n8.9, actualizar a Drupal 8.9.13.<\/li><li>Drupal\n7, actualizar a Drupal 7.78.<\/li><\/ul>\n\n\n\n<p>Las versiones de Drupal 8 anteriores a la 8.9.x\nest\u00e1n al final de su vida \u00fatil (end-of-life) y no reciben cobertura de\nseguridad.<\/p>\n\n\n\n<p>Inhabilitar cargas de tar, .tar.gz, .bz2, or .tlz archivos\npara mitigar la vulnerabilidad.<\/p>\n\n\n\n<p><strong>Fuentes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Drupal. Security\nadvisories. Drupal core &#8211; Critical &#8211; Third-party libraries &#8211; SA-CORE-2021-001. 20\nde enero del 2021. Recopilado en: <a href=\"https:\/\/www.drupal.org\/sa-core-2021-001\">https:\/\/www.drupal.org\/sa-core-2021-001<\/a><\/li><li>Common\nVulnerabilities and Exposures. Recopilado en: https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-36193<\/li><li>CSIRT\nChile. 22 de enero del 2021. Vulnerabilidades. Recopilado en: https:\/\/www.csirt.gob.cl\/vulnerabilidades\/9vsa21-00371-01\/<\/li><\/ul>\n\n\n\n<p><strong>Informaci\u00f3n de contacto<\/strong><br>\nCSIRT PANAMA<br>\nComputer Security Incident Response Team Autoridad Nacional para la Innovacion\nGubernamental<br>\nE-Mail: info@cert.pa<br>\nPhone: +507 520-CERT (2378)<br>\nWeb: https:\/\/cert.pa<br>\nTwitter: @CSIRTPanama<br>\nKey ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CSIRT Panam\u00e1 Aviso 2021-25-01 Drupal: Mitigaciones obtenidas de Drupal. Gravedad: Alta&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Fecha de publicaci\u00f3n: Enero 25, 2021 \u00daltima revisi\u00f3n: Enero 25, 2021 Portal: https:\/\/www.drupal.org\/ Sistemas Afectados: Vulnerabilidades que afectan a los sistemas Drupal que usan&#8230;<\/p>\n","protected":false},"author":4,"featured_media":941,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[72,10],"class_list":["post-2532","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad","tag-avisos-de-seguridad","tag-drupal"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2532","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2532"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2532\/revisions"}],"predecessor-version":[{"id":2533,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2532\/revisions\/2533"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/941"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2532"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2532"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2532"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}