Drupal to secure its update process with HTTPS

The Drupal security team is working to add HTTPS support to updates and to fix other issues with the update mechanism

Developers of the popular Drupal content management system are working to secure the software's update mechanism after a researcher recently found weaknesses in it.

Last week, researcher Fernando Arnaboldi from security firm IOActive disclosed several issues with the update mechanism in Drupal: the failure of the back-end administration panel to report update errors, a cross-site request forgery (CSRF) flaw that could allow attackers to force admins to repeatedly trigger update checks, and the lack of encryption for update downloads.

The last issue was the most significant one, because it could have allowed attackers who could intercept the traffic between a Drupal-based site and the official Drupal servers, to inject back-doored updates. Such an attack could lead to the compromise of the site and its database.

Fortunately, the Drupal security team was notified in advance and is working to fix the update shortcomings. Over the past few days the team has switched the project's infrastructure to support HTTPS so that the update processes for the Drupal core and its modules use secure channels.

For now the team has enabled HTTPS updates in Drush, a popular command-line shell and scripting interface for Drupal. It has also switched all download links from the project's pages to HTTPS.

The core update status module still doesn't use secure transport, but this is being worked on and will be deployed in the next Drupal update, the security team said in a blog post.

For now, website administrators can use a supported version of Drush to deploy updates or can manually download the release archives from their corresponding project pages.

The failed update notification issue and the CSRF flaw have not been addressed yet, but the Drupal security team opened tracking tickets for them and asked developers to contribute patches.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Lucian Constantin

Lucian Constantin

IDG News Service
Show Comments

Essentials

Brother MFC-L3745CDW Colour Laser Multifunction

Learn more >

Mobile

Exec

Sony WH-1000XM4 Wireless Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?