In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses     the third-party PEAR Archive_Tar library. This library has released a security update which impacts some     Drupal configurations. Refer to CVE-2018-1000888 for details (CVE-2019-6338)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses
    the third-party PEAR Archive_Tar library. This library has released a security update which impacts some
    Drupal configurations. Refer to CVE-2018-1000888 for details (CVE-2019-6338)

Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details. Also a possible regression caused by CVE-2019-6339 is fixed.

For Debian 8 'Jessie', this problem has been fixed in version 7.32-1+deb8u15.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

- A flaw exists in third-party PEAR Archive_Tar library.

- A flaw exists in PHP's built-in phar stream wrapper that could lead to a remote code execution when performing file operations on an untrusted phar:// URI.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities were found in Drupal, a fully-featured content management framework, which could result in arbitrary code execution.

For additional information, please refer to the upstream advisories at: https://www.drupal.org/sa-core-2019-001 and https://www.drupal.org/sa-core-2019-002

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.62, 8.5.x prior to 8.5.9, or 8.6.x prior to 8.6.6. It is, therefore, affected by multiple phar handling vulnerabilities. An unauthenticated attacker could leverage these vulnerabilities to potentially perform remote code execution attacks and gain access in the context the web server user.

ID	Name	Product	Family	Type	Severity
246088	Linux Distros Unpatched Vulnerability : CVE-2019-6338	Nessus	Misc.	Local	high
422416	SCA: security update for drupal/drupal (GHSA-6rmq-x2hv-vxpp)	Tenable Cloud Security	SCA Checks	Local	high
422416	SCA: security update for drupal/drupal (GHSA-6rmq-x2hv-vxpp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
122320	Debian DLA-1685-1 : drupal7 security update	Nessus	Debian Local Security Checks	Local	high
98587	Drupal 8.6.x < 8.6.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98586	Drupal 8.x < 8.5.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98585	Drupal 7.x < 7.62 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
121234	Debian DSA-4370-1 : drupal7 - security update	Nessus	Debian Local Security Checks	Local	critical
121214	Drupal 7.x < 7.62 / 8.5.x < 8.5.9 / 8.6.x < 8.6.6 Multiple Vulnerabilities (SA-CORE-2019-001, SA-CORE-2019-002)	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2019-6338

high

Tenable Plugins

high

high

high

high

critical

critical

critical

critical

critical