SA-CONTRIB-2013-014 - Drush Debian Packaging - Information Disclosure - Unsupported

This package is a tool to build debian packages from a Drupal instance.

The module doesn’t sufficiently protect database credentials.

This vulnerability is mitigated by the fact that an attacker must have shell access to the server.

CVE identifier(s) issued

• CVE-2013-0260

Versions affected

• All versions.

Drupal core is not affected. If you do not use the contributed Drush Debian Packaging module, there is nothing you need to do.

Solution

Uninstall the package.

Also see the Drush Debian Packaging project page.

Reported by

• jiri-catalyst

Fixed by

Not applicable.

Coordinated by

• Greg Knaddison of the Drupal Security Team