CVE-2017-6928

NameCVE-2017-6928
DescriptionDrupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another is trying to deny it, leading to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs for unusual site configurations.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1295-1, DSA-4123-1
NVD severitylow (attack range: remote)
Debian Bugs891152

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
drupal7 (PTS)jessie7.32-1+deb8u9vulnerable
jessie (security)7.32-1+deb8u12fixed
stretch7.52-2+deb9u2fixed
stretch (security)7.52-2+deb9u4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
drupal7source(unstable)7.57-1low891152
drupal7sourcejessie7.32-1+deb8u10lowDSA-4123-1
drupal7sourcestretch7.52-2+deb9u2lowDSA-4123-1
drupal7sourcewheezy7.14-2+deb7u17lowDLA-1295-1

Notes

https://www.drupal.org/sa-core-2018-001

Search for package or bug name: Reporting problems