Posts by theemstra

Thanks for your report.

This is a known bug in 1.2.17 and 1.3.0. It has been fixed in 1.3.x and will be part of the next 1.3.1 release.

There has been a new vulnerability found in Apache/CGI.
Details on: https://httpoxy.org/

View online: https://www.drupal.org/SA-CORE-2016-003

* Advisory ID: DRUPAL-SA-2016-002
* Project: Drupal core [1]
* Version: 8.x
* Date: 2016-July-18
* Security risk: 20/25 ( Highly Critical)
AC:Basic/A:None/CI:All/II:All/E:Proof/TD:Default [2]
* Vulnerability: Injection

-------- DESCRIPTION
---------------------------------------------------------

Drupal 8 uses the third-party PHP library Guzzle for making server-side HTTP
requests. An attacker can provide a proxy server that Guzzle will use. The
details of this are explained at https://httpoxy.org/ [3].

-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

* /A CVE identifier [4] will be requested, and added upon issuance, in
accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

* Drupal core 8.x versions prior to 8.1.7

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

* If you use Drupal 8.x, upgrade to Drupal core 8.1.7 [5]
* If you use Drupal 7.x, Drupal core is not affected. However you should
consider using the mitigation steps at https://httpoxy.org/ [6] since you
might have modules or other software on your server affected by this
issue. For example, sites using Apache can add the following code to
.htaccess:

RequestHeader unset Proxy

We also suggest mitigating it as described here: https://httpoxy.org/ [7]

Also see the Drupal core [8] project page.

-------- WHAT IF I AM RUNNING DRUPAL CORE 8.0.X?
-----------------------------

Drupal core 8.0.x is no longer supported. Update to 8.1.7 to get the latest
security and bug fixes.

-------- WHY IS THIS BEING RELEASED MONDAY RATHER THAN WEDNESDAY?
------------

The Drupal Security Team usually releases Security Advisories on Wednesdays.
However, this vulnerability affects more than Drupal, and the authors of
Guzzle and reporters of the issue coordinated to make it public Monday.
Therefore, we are issuing a core release to update to the secure version of
Guzzle today.

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at https://www.drupal.org/contact [9].

Learn more about the Drupal Security team and their policies [10], writing
secure code for Drupal [11], and securing your site [12].

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [13]

[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3] https://httpoxy.org/
[4] http://cve.mitre.org/
[5] https://www.drupal.org/project/drupal/releases/8.1.7
[6] https://httpoxy.org/
[7] https://httpoxy.org/
[8] https://www.drupal.org/project/drupal
[9] https://www.drupal.org/contact
[10] https://www.drupal.org/security-team
[11] https://www.drupal.org/writing-secure-code
[12] https://www.drupal.org/security/secure-configuration
[13] https://twitter.com/drupalsecurity

Quote from check

i did use the search funtion thats why i ask the search results are way to confusing and not clear.

@ Ninos so you say i dont have to do anything just install and activate and then its all auto update
and i dont need the cronjob plugin for this

The renewal feature doesn't require another plugin

The cronjob plugin allows clients to make custom cronjobs.

Hi @Viktor

Thanks for your question. Please use the search feature of this forum, as this question has been answered a few times before.
If you need any other help, feel free to open another thread.

- Thom

@SventeHof This is a known bug from 1.2.x series, this is fixed in 1.3.0 and the future 1.3.1 (git 1.3.x) version.

http://youtrack.i-mscp.net/issue/IP-1563

You should be more exact.

Do you mean you want to sign emails (PGP or such?)
Do you mean you want to connect over IMAP/SMTP using the cert?

If the latter one, at the moment this is not implemented, you can only add 1 cert for IMAP/SMTP for the whole server, correct @Nuxwin?.

Please be more specific, then @Ninos can try to answer your question.

You should indeed add the mail servers to the external mail feature, then add MX records to the domain manually.
You can check if this worked by going in SSH/console and typing: dig MX mydomain.tld @127.0.0.1

If it doesn't work, please post the outcome of the dig command and show screenshots from external mail page + your DNS records, so we can take a look.

Do you use the mailman plugin? If yes, what version?

Quote from UncleSam

Hallo,

just a short question about the new HSTS feature:
If I enable the include subdomains feature at my main domain (http://www.domain.tld), is it enabled for every subdomain?

Thanks for your question, @'Ninos' will add a little more info to the tooltip for a future release.

Yes! That's exactly what that means.

It is enabled for that domain and its subdomains, not for other domains.