{"id":3051,"date":"2022-05-31T11:27:11","date_gmt":"2022-05-31T16:27:11","guid":{"rendered":"https:\/\/cert.pa\/?p=3051"},"modified":"2022-05-31T11:27:11","modified_gmt":"2022-05-31T16:27:11","slug":"csirt-panama-aviso-2022-05-31-drupal-vulnerabilidad-en-el-core-de-drupal","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=3051","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2022-05-31 Drupal: Vulnerabilidad en el core de Drupal"},"content":{"rendered":"\n

CSIRT Panam\u00e1 Aviso 2022-05-31 Drupal: Vulnerabilidad en el core de Drupal<\/p>\n\n\n\n

Gravedad: Media
Fecha de publicaci\u00f3n: Mayo 31, 2022
\u00daltima revisi\u00f3n: Mayo 31, 2022
Sitio web: https:\/\/www.drupal.org\/
Sistemas Afectados:<\/p>\n\n\n\n

  1. Versiones Drupal core 9.3 anteriores a 9.3.14.<\/li>
  2. Versiones Drupal core 9.4 anteriores a 9.2.20.<\/li>
  3. Todas las versiones de Drupal 9 anteriores a 9.2.x, junto con Drupal 8, est\u00e1n al final de su vida \u00fatil (EOL) y no reciben cobertura de seguridad.<\/li>
  4. Drupal 7 no est\u00e1 afectado.<\/li><\/ol>\n\n\n\n

    I.Descripci\u00f3n<\/strong><\/p>\n\n\n\n

    Dezso BICZ\u00d3 y mayela han reportado una vulnerabilidad de severidad media en la librer\u00eda Guzzle, que podr\u00eda afectar a algunos proyectos contribuidos o al c\u00f3digo personalizado de las webs que usan Drupal.<\/p>\n\n\n\n

    II.Impacto<\/strong><\/p>\n\n\n\n

    Vulnerabilidad: CVE-2022-29248<\/p>\n\n\n\n

    Drupal utiliza la librer\u00eda externa Guzzle para gestionar las solicitudes y respuestas HTTP a los servicios externos. La vulnerabilidad en Guzzle consiste en que no se comprueba si el dominio de la cookie es igual al dominio del servidor que establece la cookie a trav\u00e9s de la cabecera Set-Cookie, lo que podr\u00eda permitir a un servidor malicioso establecer cookies para dominios no relacionados.<\/p>\n\n\n\n

    III. Referencia a soluciones, herramientas e informaci\u00f3n<\/strong><\/p>\n\n\n\n

    Actualizar a las versiones correspondientes:<\/p>\n\n\n\n

    1. Drupal 9.3 a la versi\u00f3n 9.3.14; enlace: https:\/\/www.drupal.org\/project\/drupal\/releases\/9.3.14<\/li>
    2. Drupal 9.2 a la versi\u00f3n 9.2.20; enlace: https:\/\/www.drupal.org\/project\/drupal\/releases\/9.2.20<\/li><\/ol>\n\n\n\n

      Fuentes:<\/strong><\/p>\n\n\n\n

      1. Instituto Nacional de Ciberseguridad, INCIBE. Avisos Seguridad, Vulnerabilidad en el core de Drupal. 26 de mayo del 2022. Recopilado en: https:\/\/www.incibe-cert.es\/alerta-temprana\/avisos-seguridad\/vulnerabilidad-el-core-drupal-4<\/li>
      2. Drupal. Security advisories, Drupal core – Moderately critical – Third-party libraries – SA-CORE-2022-010. 25 de mayo del 2022. Recopilado en: https:\/\/www.drupal.org\/sa-core-2022-010<\/li>
      3. GitHub. Cross-domain cookie leakage. 26 de mayo del 2022. Recopilado en: https:\/\/github.com\/guzzle\/guzzle\/security\/advisories\/GHSA-cwmx-hcrq-mhc3<\/li><\/ol>\n\n\n\n

        Informaci\u00f3n de contacto<\/strong>
        CSIRT PANAMA
        Computer Security Incident Response Team Autoridad Nacional para la Innovacion Gubernamental
        E-Mail: info@cert.pa
        Phone: +507 520-CERT (2378)
        Web: https:\/\/cert.pa
        Twitter: @CSIRTPanama
        Key ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"

        CSIRT Panam\u00e1 Aviso 2022-05-31 Drupal: Vulnerabilidad en el core de Drupal Gravedad: MediaFecha de publicaci\u00f3n: Mayo 31, 2022\u00daltima revisi\u00f3n: Mayo 31, 2022Sitio web: https:\/\/www.drupal.org\/Sistemas Afectados: Versiones Drupal core 9.3 anteriores a 9.3.14.Versiones Drupal core 9.4…<\/p>\n","protected":false},"author":4,"featured_media":941,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-3051","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3051"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3051\/revisions"}],"predecessor-version":[{"id":3052,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3051\/revisions\/3052"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/941"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}