<div dir="ltr"><div><div>Ahoj vespolek,<br><br></div>kdo provozujete Drupal, udelejte si pristi tyden ve stredu vecer cas...<br></div><div>vyslo upozorneni na budouci bezpecnostni zaplatu vysoce kriticke chyby...<br></div><div><br></div>Jirka Volf<br><br><div><div><div><div><div><div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername"></b> <span dir="ltr"><<a href="mailto:security-news@drupal.org">security-news@drupal.org</a>></span><br>Date: 2018-03-21 20:41 GMT+01:00<br>Subject: [Security-news] Drupal 7 and 8 core critical release on March 28th, 2018 PSA-2018-001<br>To: <a href="mailto:security-news@drupal.org">security-news@drupal.org</a><br><br><br>View online: <a href="https://www.drupal.org/psa-2018-001" rel="noreferrer" target="_blank">https://www.drupal.org/psa-201<wbr>8-001</a><br>
<br>
* Advisory ID: DRUPAL-PSA-2018-001<br>
* Project: Drupal Core<br>
* Version: 7.x, 8.x<br>
* Date: 2018-March-21<br>
<br>
-------- DESCRIPTION<br>
------------------------------<wbr>---------------------------<br>
<br>
There will be a security release of *Drupal 7.x, 8.3.x, 8.4.x, and 8.5.x on<br>
March 28th 2018 between 18:00 - 19:30 UTC*, one week from the publication of<br>
this document, that will fix a highly critical security vulnerability. The<br>
Drupal Security Team urges you to reserve time for core updates at that time<br>
because exploits /might/ be developed within hours or days. Security release<br>
announcements will appear on the Drupal.org security advisory page [1].<br>
<br>
While Drupal 8.3.x and 8.4.x are no longer supported and we don't normally<br>
provide security releases for unsupported minor releases [2], given the<br>
potential severity of this issue, we /are/ providing 8.3.x and 8.4.x releases<br>
that includes the fix for sites which have not yet had a chance to update to<br>
8.5.0. The Drupal security team strongly recommends the following:<br>
* Sites on 8.3.x should immediately update to the 8.3.x release that willbe<br>
provided in the advisory, and then plan to update to the latest 8.5.x<br>
security release in the next month.<br>
* Sites on 8.4.x should immediately update to the 8.4.x release that willbe<br>
provided in the advisory, and then plan to update to the latest 8.5.x<br>
security release in the next month.<br>
* Sites on 7.x or 8.5.x can immediately update when the advisory isreleased<br>
using the normal procedure.<br>
<br>
The security advisory will list the appropriate version numbers for all three<br>
Drupal 8 branches. Your site's update report page will recommend the 8.5.x<br>
release even if you are on 8.3.x or 8.4.x, but temporarily updating to the<br>
provided backport for your site's current version will ensure you can update<br>
quickly without the possible side effects of a minor version update.<br>
<br>
The Security Team or any other party is not able to release any more<br>
information about this vulnerability until the announcement is made. The<br>
announcement will be made public at <a href="http://www.drupal.org/security" rel="noreferrer" target="_blank">www.drupal.org/security</a> [3], over<br>
Twitter, and in email for those who have subscribed to our email list. To<br>
subscribe to the email list: log in on <a href="http://drupal.org" rel="noreferrer" target="_blank">drupal.org</a>, go to your user profile<br>
page and subscribe to the security newsletter on the Edit » My newsletters<br>
tab.<br>
<br>
Journalists interested in covering the story are encouraged to email<br>
<a href="mailto:security-press@drupal.org" target="_blank">security-press@drupal.org</a> to be sure they will get a copy of the<br>
journalist-focused release. The Security Team will release a<br>
journalist-focused summary email at the same time as the new code release and<br>
advisory.<br>
<br>
If you find a security issue, please report it at<br>
<a href="https://www.drupal.org/security-team/report-issue" rel="noreferrer" target="_blank">https://www.drupal.org/securit<wbr>y-team/report-issue</a> [4].<br>
<br>
[1] <a href="https://www.drupal.org/security" rel="noreferrer" target="_blank">https://www.drupal.org/securit<wbr>y</a><br>
[2] <a href="https://www.drupal.org/core/release-cycle-overview" rel="noreferrer" target="_blank">https://www.drupal.org/core/re<wbr>lease-cycle-overview</a><br>
[3] <a href="http://www.drupal.org/security" rel="noreferrer" target="_blank">www.drupal.org/security</a><br>
[4] <a href="https://www.drupal.org/security-team/report-issue" rel="noreferrer" target="_blank">https://www.drupal.org/securit<wbr>y-team/report-issue</a><br>
<br>
______________________________<wbr>_________________<br>
Security-news mailing list<br>
<a href="mailto:Security-news@drupal.org" target="_blank">Security-news@drupal.org</a><br>
Unsubscribe at <a href="https://lists.drupal.org/mailman/listinfo/security-news" rel="noreferrer" target="_blank">https://lists.drupal.org/mailm<wbr>an/listinfo/security-news</a><br>
</div><br></div></div></div></div></div></div>