-https://www.drupal.org/project/drupal/releases/8.4.8

    -https://www.drupal.org/SA-CORE-2018-004

-https://www.drupal.org/project/drupal/releases/8.4.7

    -https://www.drupal.org/sa-core-2018-003

RPMの更新：`drupal8-rpmbuild`パッケージの依存関係が修正されました

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

- [8.4.6]（https://www.drupal.org/project/drupal/releases/8.4.6）

  - [SA-CORE-2018-002（CVE-2018-7600）]（https://www.drupal.org/SA-CORE-2018-002）

  - [8.4.5]（https://www.drupal.org/project/drupal/releases/8.4.5）

  - [SA-CORE-2018-001（CVE-2017-6926 / CVE-2017-6927 / CVE-2017-6930 / CVE-2017-6931）]（https://www.drupal.org/SA-CORE-2018-001）

  - [8.4.4]（https://www.drupal.org/project/drupal/releases/8.4.4）

  - [8.4.3]（https://www.drupal.org/project/drupal/releases/8.4.3）

  - [8.4.2]（https://www.drupal.org/project/drupal/releases/8.4.2）

  - [8.4.1]（https://www.drupal.org/project/drupal/releases/8.4.1）

  - [8.4.0]（https://www.drupal.org/project/drupal/releases/8.4.0）

  - [8.4.0-rc2]（https://www.drupal.org/project/drupal/releases/8.4.0-rc2）

  - [8.4.0-rc1]（https://www.drupal.org/project/drupal/releases/8.4.0-rc1）

  - [8.4.0-beta1]（https://www.drupal.org/project/drupal/releases/8.4.0-beta1）

  - [8.4.0-alpha1]（https://www.drupal.org/project/drupal/releases/8.4.0-alpha1）

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

Jasper Mattsson found a remote code execution vulnerability in the Drupal content management system. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised.

For further information please refer to the official upstream advisory at https://www.drupal.org/sa-core-2018-002.

For Debian 7 'Wheezy', these problems have been fixed in version 7.14-2+deb7u18.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

-     [8.3.9](https://www.drupal.org/project/drupal/releases/8     .3.9)

  - [SA-CORE-2018-002     (CVE-2018-7600)](https://www.drupal.org/SA-CORE-2018-002     )

  -     [8.3.8](https://www.drupal.org/project/drupal/releases/8     .3.8)

  - [SA-CORE-2018-001 (CVE-2017-6926 / CVE-2017-6927 /     CVE-2017-6930 /     CVE-2017-6931)](https://www.drupal.org/SA-CORE-2018-001)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

-     [8.4.6](https://www.drupal.org/project/drupal/releases/8     .4.6)

  - [SA-CORE-2018-002     (CVE-2018-7600)](https://www.drupal.org/SA-CORE-2018-002     )

  -     [8.4.5](https://www.drupal.org/project/drupal/releases/8     .4.5)

  - [SA-CORE-2018-001 (CVE-2017-6926 / CVE-2017-6927 /     CVE-2017-6930 /     CVE-2017-6931)](https://www.drupal.org/SA-CORE-2018-001)

  -     [8.4.4](https://www.drupal.org/project/drupal/releases/8     .4.4)

  -     [8.4.3](https://www.drupal.org/project/drupal/releases/8     .4.3)

  -     [8.4.2](https://www.drupal.org/project/drupal/releases/8     .4.2)

  -     [8.4.1](https://www.drupal.org/project/drupal/releases/8     .4.1)

  -     [8.4.0](https://www.drupal.org/project/drupal/releases/8     .4.0)

  -     [8.4.0-rc2](https://www.drupal.org/project/drupal/releas     es/8.4.0-rc2)

  -     [8.4.0-rc1](https://www.drupal.org/project/drupal/releas     es/8.4.0-rc1)

  -     [8.4.0-beta1](https://www.drupal.org/project/drupal/rele     ases/8.4.0-beta1)

  -     [8.4.0-alpha1](https://www.drupal.org/project/drupal/rel     eases/8.4.0-alpha1)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- https://www.drupal.org/project/drupal/releases/8.4.8

    - https://www.drupal.org/SA-CORE-2018-004

- https://www.drupal.org/project/drupal/releases/8.4.7

    - https://www.drupal.org/sa-core-2018-003

RPM update: `drupal8-rpmbuild` package dependencies fixed

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- https://www.drupal.org/project/drupal/releases/7.59

    - https://www.drupal.org/SA-CORE-2018-004

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Drupal installed on the remote server is 7.x prior to 7.58, and is affected by a flaw in the 'preHandle()' function in 'core/lib/Drupal/Core/DrupalKernel.php' that is triggered as certain parameter keys within HTTP requests are not properly sanitized. This may allow a remote attacker to execute arbitrary code. This issue may be exploited using multiple unspecified attack vectors.

The version of Drupal installed on the remote server is 8.x prior to 8.3.9, and is affected by a flaw in the 'preHandle()' function in 'core/lib/Drupal/Core/DrupalKernel.php' that is triggered as certain parameter keys within HTTP requests are not properly sanitized. This may allow a remote attacker to execute arbitrary code. This issue may be exploited using multiple unspecified attack vectors.

The version of Drupal installed on the remote server is 8.4.x prior to 8.4.6, and is affected by a flaw in the 'preHandle()' function in 'core/lib/Drupal/Core/DrupalKernel.php' that is triggered as certain parameter keys within HTTP requests are not properly sanitized. This may allow a remote attacker to execute arbitrary code. This issue may be exploited using multiple unspecified attack vectors.

The version of Drupal installed on the remote server is 8.5.x prior to 8.5.1, and is affected by a flaw in the 'preHandle()' function in 'core/lib/Drupal/Core/DrupalKernel.php' that is triggered as certain parameter keys within HTTP requests are not properly sanitized. This may allow a remote attacker to execute arbitrary code. This issue may be exploited using multiple unspecified attack vectors.

ID	名稱	產品	系列	已發布	已更新	嚴重性
120613	Fedora 28：drupal8（2018-8fd924a53d）（Drupalgeddon 2）	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/2	critical
120615	Fedora 28：drupal8（2018-906ba26b4d）（Drupalgeddon 2）	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/2	critical
108695	Debian DLA-1325-1 : drupal7 security update (Drupalgeddon 2)	Nessus	Debian Local Security Checks	2018/3/29	2022/12/5	critical
109288	Fedora 26 : drupal8 (2018-922cc2fbaa) (Drupalgeddon 2)	Nessus	Fedora Local Security Checks	2018/4/24	2022/12/5	critical
120615	Fedora 28 : drupal8 (2018-906ba26b4d) (Drupalgeddon 2)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/2	critical
109705	Fedora 27 : drupal8 (2018-1ba93b3144) (Drupalgeddon 2)	Nessus	Fedora Local Security Checks	2018/5/11	2022/4/22	critical
109706	Fedora 26 : drupal7 (2018-2359c2ae0e) (Drupalgeddon 2)	Nessus	Fedora Local Security Checks	2018/5/11	2022/4/22	critical
120613	Fedora 28 : drupal8 (2018-8fd924a53d) (Drupalgeddon 2)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/2	critical
700224	Drupal 7.x < 7.58 RCE	Nessus Network Monitor	CGI	2018/3/29	2019/3/6	critical
700228	Drupal 8.x < 8.3.9 RCE	Nessus Network Monitor	CGI	2018/3/29	2019/3/6	critical
700229	Drupal 8.4.x < 8.4.6 RCE	Nessus Network Monitor	CGI	2018/3/29	2019/3/6	critical
700230	Drupal 8.5.x < 8.5.1 RCE	Nessus Network Monitor	CGI	2018/3/29	2019/3/6	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical