Drupal Release: 9.4.12

TL;DR

Drupal 9.4.12: Critical Security Update

This release addresses three critical security vulnerabilities (SA-CORE-2023-002, SA-CORE-2023-003, and SA-CORE-2023-004) that could potentially expose your Drupal site to various attacks. All Drupal 9.4.x users should upgrade immediately to version 9.4.12 to protect their sites from these security issues. This is a maintenance release focused entirely on security fixes with no new features or other changes.

Highlight of the Release

• Addresses three critical security advisories: SA-CORE-2023-002, SA-CORE-2023-003, and SA-CORE-2023-004
• Security-only release with no new features or non-security bug fixes
• Recommended immediate upgrade for all Drupal 9.4.x sites

Migration Guide

No specific migration steps are required for this update beyond the standard Drupal update process:

1. Back up your database and site files
2. Put your site into maintenance mode
3. Update Drupal core to version 9.4.12
4. Run the database update script by visiting /update.php in your browser
5. Take your site out of maintenance mode

As this is a security-only release, there should be no compatibility issues with existing functionality.

Upgrade Recommendations

Immediate Upgrade Strongly Recommended

This release contains fixes for critical security vulnerabilities. All sites running Drupal 9.4.x should upgrade to Drupal 9.4.12 immediately.

If you are unable to update immediately, consider temporarily taking your site offline until you can apply the update to prevent potential exploitation of these vulnerabilities.

For sites running older versions of Drupal (9.3.x or earlier), you should upgrade to the latest secure version for your branch or consider upgrading to Drupal 9.4.12 or Drupal 10 if possible.

Bug Fixes

This release addresses three critical security vulnerabilities:

SA-CORE-2023-002

A security vulnerability that was identified and fixed by a team of contributors including larowlan, james.williams, xjm, longwave, danflanagan8, jenlampton, pandaski, and benjifisher.

SA-CORE-2023-003

A security vulnerability that was identified and fixed by jan kellermann, larowlan, greggles, benjifisher, xjm, Berdir, drumm, and longwave.

SA-CORE-2023-004

A security vulnerability that was identified and fixed by DamienMcKenna, elarlang, larowlan, effulgentsia, pandaski, mcdruid, jenlampton, quicksketch, and greggles.

Note: Specific details about these vulnerabilities are intentionally limited in the release notes to prevent exploitation of sites that have not yet been updated.

New Features

This release does not contain any new features as it is focused exclusively on security fixes.

Security Updates

This release addresses three critical security advisories:

SA-CORE-2023-002

This security advisory addresses a vulnerability in Drupal core. The specific details of this vulnerability are not disclosed in the release notes to protect sites that have not yet been updated. The fix was contributed by a team including larowlan, james.williams, xjm, longwave, danflanagan8, jenlampton, pandaski, and benjifisher.

SA-CORE-2023-003

This security advisory addresses another vulnerability in Drupal core. The fix was contributed by jan kellermann, larowlan, greggles, benjifisher, xjm, Berdir, drumm, and longwave.

SA-CORE-2023-004

This security advisory addresses a third vulnerability in Drupal core. The fix was contributed by DamienMcKenna, elarlang, larowlan, effulgentsia, pandaski, mcdruid, jenlampton, quicksketch, and greggles.

For more detailed information about these security vulnerabilities, please refer to the official Drupal Security Advisories once they are published.

Performance Improvements

This release does not contain any specific performance improvements as it is focused exclusively on security fixes.

Impact Summary

This release is critical for the security of all Drupal 9.4.x sites. It addresses three security vulnerabilities that could potentially be exploited if left unpatched. The security fixes were contributed by multiple Drupal security team members and community contributors, highlighting the collaborative approach to security in the Drupal ecosystem.

The update contains 37 additions and 12 deletions across 11 files, indicating targeted fixes rather than extensive changes. This should minimize the risk of the update causing unintended side effects.

Since this is a security-only release, there are no new features or non-security bug fixes included. This means that the update process should be straightforward and focused solely on addressing the security concerns.

Organizations should prioritize this update and implement it as soon as possible to protect their Drupal sites from potential security threats.