The Drupal project released a new update that fixes several security vulnerabilities. We strongly recommend upgrading your existing Drupal 7 and 8 sites.
Information regarding the additional changes is available in the official security advisory. In response to the new Drupal version, we have released the following: Bitnami Drupal 7 and 8 installers, virtual machines, and cloud images.
Two notable issues include:
1. Confirmation forms allow external URLs to be injected (Moderately critical - Drupal 7)
Under certain circumstances, malicious users could construct a URL to a confirmation form that would trick users into being redirected to a 3rd party website after interacting with the form, thereby exposing the users to potential social engineering attacks.
2. Denial of service via transliterate mechanism (Moderately critical - Drupal 8)
A specially crafted URL can cause a denial of service via the transliterate mechanism.
Our new releases fix the known security issues. There are no new features or non-security related bug fixes in these releases.
If you have questions about Bitnami Drupal or these security issues, please post to our community forum and we will be happy to help you.