Drupal Release: 10.3.9

TL;DR

Drupal 10.3.9 is a security release that addresses multiple critical and highly critical vulnerabilities. This update includes five security advisories (SA-CORE-2024-003, SA-CORE-2024-004, SA-CORE-2024-006, SA-CORE-2024-007, and SA-CORE-2024-008) that fix issues related to access bypass, remote code execution, and other security concerns. All Drupal 10.3.x sites should update immediately to this version to protect against potential exploits.

Highlight of the Release

• Addresses five security advisories: SA-CORE-2024-003, SA-CORE-2024-004, SA-CORE-2024-006, SA-CORE-2024-007, and SA-CORE-2024-008
• Fixes multiple critical and highly critical security vulnerabilities
• Includes patches from multiple security team members and contributors

Migration Guide

No migration steps are required for this update. This is a direct security update from Drupal 10.3.8 to 10.3.9 and does not introduce any API changes or require database updates.

To update:

1. Create a backup of your site files and database
2. Update Drupal core using your preferred method:
   • Composer: composer update drupal/core --with-all-dependencies
   • Manual update: Download the new version and replace core files
3. Run database updates if prompted (though none are expected for this release)
4. Clear caches

For detailed instructions, refer to the Drupal update guide.

Upgrade Recommendations

Immediate Update Strongly Recommended

This is a critical security release that addresses multiple vulnerabilities. All Drupal 10.3.x sites should be updated immediately to version 10.3.9.

If you are unable to update immediately, consider temporarily taking your site offline or implementing additional security measures until the update can be applied.

Sites running older versions of Drupal (9.x or earlier) should update to the latest security release for their respective version branch or consider upgrading to a supported version of Drupal.

Bug Fixes

This release primarily addresses security-related bugs rather than functional bugs. The specific issues fixed include:

• Fixed vulnerabilities related to access bypass (SA-CORE-2024-003)
• Addressed potential remote code execution vulnerabilities (SA-CORE-2024-004)
• Patched security issues identified in SA-CORE-2024-006
• Resolved security concerns documented in SA-CORE-2024-007
• Fixed security vulnerabilities detailed in SA-CORE-2024-008

For detailed information about these fixes, please refer to the security advisories on Drupal's security advisories page.

New Features

No new features were introduced in this release as it focuses exclusively on security fixes.

Security Updates

This release includes fixes for five security advisories:

1. SA-CORE-2024-003: Addresses access bypass vulnerabilities. Contributors: jrb, larowlan, catch, mingsong, poker10, longwave, benjifisher.

2. SA-CORE-2024-004: Fixes potential remote code execution vulnerabilities. Contributors: zengenuity, cilefen, kristiaanvandeneynde, mcdruid, larowlan.

3. SA-CORE-2024-006: Resolves security issues identified by mcdruid and larowlan.

4. SA-CORE-2024-007: Addresses security vulnerabilities discovered by mcdruid and larowlan.

5. SA-CORE-2024-008: Fixes security concerns identified by mcdruid, fabianx, poker10, larowlan, longwave, and alexpott.

The Drupal security team has not published detailed information about these vulnerabilities to prevent exploitation on unpatched sites. For more information, visit the Drupal security advisories page after updating your site.

Performance Improvements

No specific performance improvements were included in this release as it focuses exclusively on security fixes.

Impact Summary

This release addresses multiple critical and highly critical security vulnerabilities that could potentially allow attackers to compromise Drupal sites. The security fixes span various components of Drupal core and address issues including access bypass and potential remote code execution.

The impact of not updating could be severe, potentially allowing unauthorized access to your site, data theft, site defacement, or server compromise. The Drupal security team considers these issues serious enough to warrant an immediate update.

This release maintains compatibility with existing Drupal 10.3.x installations and does not introduce any breaking changes or API modifications. The update is focused solely on security improvements and does not affect site functionality or performance.