CVE-2017-6920: PECL YAML parser unsafe object handling
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.3.4 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.3.4 - Upgrade
Upgrade
Drupal coreto a version that resolves this vulnerability.Fixed in 8.3.4
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6920?
CVE-2017-6920 is classified as a critical vulnerability due to its ability to allow remote code execution.
How do I fix CVE-2017-6920?
To fix CVE-2017-6920, upgrade Drupal core and Drupal to version 8.3.4 or later.
Which versions of Drupal are affected by CVE-2017-6920?
CVE-2017-6920 affects Drupal core versions prior to 8.3.4 including 8.0.x, 8.1.x, and 8.2.x.
What type of vulnerability is CVE-2017-6920?
CVE-2017-6920 is a remote code execution vulnerability due to unsafe object handling by the PECL YAML parser.
Can CVE-2017-6920 be exploited remotely?
Yes, CVE-2017-6920 can be exploited remotely, allowing attackers to execute arbitrary code on the server.