There is a security release for doctrine that includes annotations, cache and common.
http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vul...
composer update doctrine/common

Proposed resolution

Bring doctrine/common up to 2.4.3, annotations to 1.2.7 and cache to 1.3.2

Beta phase evaluation

Reference: https://www.drupal.org/core/beta-changes
Issue category Task because no functionality changes.
Issue priority Major because security release
CommentFileSizeAuthor
#21 update_doctrine_common-2105825-21.patch650.32 KBhussainweb
#21 update_doctrine_common-2105825-21-do-not-test.patch14.89 KBhussainweb
#17 doctrine-2105825.10.patch588.17 KBlarowlan
#16 doctrine-2105825.16.patch544.97 KBlarowlan
#16 doctrine-2105825.do-not-test.patch13.84 KBlarowlan
#6 update_doctrine-2105825-5.patch92.57 KBNitesh Sethia
#5 update_doctrine-2105825-5.patch92.57 KBNitesh Sethia
#3 UpdateDoctrine.patch123.93 KBcosmicdreams
#1 Doctrine241.patch123.92 KBcosmicdreams
DoctrineUpdates.patch27.62 KBcosmicdreams
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

cosmicdreams’s picture

cosmicdreams CreditAttribution: cosmicdreams commented
FileSize
Doctrine241.patch123.92 KB

I messed up other similar patches earlier today. So I'm resubmitting this one to be sure I'm submitting a patch and contains the entire update.

This issue is actually rather important because the previous version was an RC candidate and this one is 2.4.1.
Looks like there are some caching stuff that was included.

cosmicdreams’s picture

cosmicdreams CreditAttribution: cosmicdreams commented
Title: Updated Doctrine Component » Updat Doctrine Component to 2.4.1
cosmicdreams’s picture

cosmicdreams CreditAttribution: cosmicdreams commented
Title: Updat Doctrine Component to 2.4.1 » Update Doctrine Component to 2.4.1
FileSize
UpdateDoctrine.patch123.93 KB

reroll because another library was updated. Upgrade to stable.

jhedstrom’s picture

jhedstrom
Primary language English
Location Portland, OR
CreditAttribution: jhedstrom commented
Issue summary: View changes
Status: Needs review » Needs work
Issue tags: +Needs reroll

Patch no longer applies.

Also, related #2325779: Upgrade to Doctrine v1.2.0.

Nitesh Sethia’s picture

Nitesh Sethia CreditAttribution: Nitesh Sethia as a volunteer commented
FileSize
update_doctrine-2105825-5.patch92.57 KB

Rerolled the patch successfully.

Nitesh Sethia’s picture

Nitesh Sethia CreditAttribution: Nitesh Sethia as a volunteer commented
Status: Needs work » Needs review
FileSize
update_doctrine-2105825-5.patch92.57 KB

Rerolled the patch.

dawehner’s picture

dawehner
Primary language German
CreditAttribution: dawehner as a volunteer commented

Mh, the patch removes lines related to behat/mink, but never adds something like that back ... are we sure that this is something what we want? (not sure either)

cosmicdreams’s picture

cosmicdreams CreditAttribution: cosmicdreams as a volunteer commented

This patch was first created before the inclusion of behat / mink. This patch will require more than a straight reroll in order to be accepted.

dawehner’s picture

dawehner
Primary language German
CreditAttribution: dawehner as a volunteer commented
Status: Needs review » Needs work
Issue tags: -Needs reroll

Yeah this is what I thought as well.

Let's be clear, the reroll tag is confusing to start with .

cosmicdreams’s picture

cosmicdreams CreditAttribution: cosmicdreams as a volunteer commented

Futhermore, the current version of doctrine/common is 2.4.2. That's the most current 2.4.x version of the package.

It is more difficult to discern but I think we're using doctrine/annotations 1.2.1. That could be updated to 1.2.4 without much conflict.

So perhaps I should rename this issue to focus it better.

cosmicdreams’s picture

cosmicdreams CreditAttribution: cosmicdreams as a volunteer commented
Title: Update Doctrine Component to 2.4.1 » Update Doctrine Annotations Component to 1.2.4
Category: Bug report » Task
Issue summary: View changes

Rewrote issue summary and added a beta evaluation here. This is a small task that could be knocked out at an upcoming Drupal Camp like TC Drupal Camp

cosmicdreams’s picture

cosmicdreams CreditAttribution: cosmicdreams as a volunteer commented
Issue summary: View changes

Ha, looksl like I added two beta summaries.

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
CreditAttribution: larowlan as a volunteer commented
Title: Update Doctrine Annotations Component to 1.2.4 » Update Doctrine Annotations Component to 1.2.7
Priority: Normal » Major
Issue summary: View changes

1.2.7 is out and is a security release http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vul...

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
CreditAttribution: larowlan as a volunteer commented
Title: Update Doctrine Annotations Component to 1.2.7 » Update Doctrine/common Component to 2.4.3 (security) (includes cache/annotations too)
Issue summary: View changes
Issue tags: +Security

Closed #2493909: Update doctrine/cache to the latest stable release as duplicate.

Please add naveenvalecha, iMiksu, edysmp to commit credits.

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
CreditAttribution: larowlan as a volunteer commented
Issue summary: View changes
larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
CreditAttribution: larowlan at PreviousNext commented
Status: Needs work » Needs review
FileSize
doctrine-2105825.do-not-test.patch13.84 KB
doctrine-2105825.16.patch544.97 KB 
[rowlands@Lees-MacBook-Pro core (doctrine-2105825)]$ composer update "doctrine/*" --prefer-dist
Loading composer repositories with package information
Updating dependencies (including require-dev)
  - Removing doctrine/annotations (v1.2.1)
  - Installing doctrine/annotations (v1.2.7)
    Downloading: 100%

  - Removing doctrine/collections (v1.2)
  - Installing doctrine/collections (v1.3.0)
    Loading from cache

  - Removing doctrine/cache (v1.3.1)
  - Installing doctrine/cache (v1.4.2)
    Downloading: 100%

  - Removing doctrine/inflector (v1.0)
  - Installing doctrine/inflector (v1.0.1)
    Loading from cache

  - Removing doctrine/common (v2.4.2)
  - Installing doctrine/common (v2.4.3)
    Downloading: 100%

  - Removing doctrine/instantiator (1.0.4)
  - Installing doctrine/instantiator (1.0.5)
    Loading from cache

Writing lock file
Generating autoload files
> Drupal\Core\Composer\Composer::preAutoloadDump
> Drupal\Core\Composer\Composer::ensureHtaccess
larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
CreditAttribution: larowlan at PreviousNext commented
FileSize
doctrine-2105825.10.patch588.17 KB

Missed new files

kim.pepper’s picture

kim.pepper
Primary language English
Location 🏄‍♂️🇦🇺Sydney, Australia
CreditAttribution: kim.pepper at PreviousNext commented
Status: Needs review » Reviewed & tested by the community

This looks simple enough, and tests are green.

The last submitted patch, 5: update_doctrine-2105825-5.patch, failed testing.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
CreditAttribution: webchick at Acquia commented
Parent issue: » #2400407: [meta] Ensure vendor (PHP) libraries are on latest stable release

We should be able to get this in soon after tagging beta 15.

hussainweb’s picture

hussainweb
Primary language English
CreditAttribution: hussainweb at Axelerant commented
Status: Reviewed & tested by the community » Needs review
FileSize
update_doctrine_common-2105825-21-do-not-test.patch14.89 KB
update_doctrine_common-2105825-21.patch650.32 KB

2.5.1 is out, which contains the same security fix, and we could as well try to update the minor here. I don't want to hijack this issue but it seems wasteful to create another one.

hw@d8:/var/www/d8task/core-[git 8.0.x] $ composer require doctrine/common:"2.5.*"
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
  - Removing doctrine/common (v2.4.2)
  - Installing doctrine/common (v2.5.1)
    Loading from cache

Writing lock file
Generating autoload files
> Drupal\Core\Composer\Composer::preAutoloadDump
> Drupal\Core\Composer\Composer::ensureHtaccess
hw@d8:/var/www/d8task/core-[git 8.0.x] $ composer update "doctrine/*" --prefer-dist
Loading composer repositories with package information
Updating dependencies (including require-dev)
  - Removing doctrine/annotations (v1.2.1)
  - Installing doctrine/annotations (v1.2.7)
    Downloading: 100%

  - Removing doctrine/instantiator (1.0.4)
  - Installing doctrine/instantiator (1.0.5)
    Loading from cache

  - Removing doctrine/cache (v1.3.1)
  - Installing doctrine/cache (v1.4.2)
    Downloading: 100%

  - Removing doctrine/collections (v1.2)
  - Installing doctrine/collections (v1.3.0)
    Downloading: 100%

  - Removing doctrine/inflector (v1.0)
  - Installing doctrine/inflector (v1.0.1)
    Downloading: 100%

Writing lock file
Generating autoload files
> Drupal\Core\Composer\Composer::preAutoloadDump
> Drupal\Core\Composer\Composer::ensureHtaccess

If you want to deal with that upgrade in another issue, this could go back to RTBC as per #18.

dawehner’s picture

dawehner
Primary language German
CreditAttribution: dawehner as a volunteer commented
Status: Needs review » Reviewed & tested by the community

+1

Well the other patch is not green anway

hussainweb’s picture

hussainweb
Primary language English
CreditAttribution: hussainweb at Axelerant commented
Title: Update Doctrine/common Component to 2.4.3 (security) (includes cache/annotations too) » Update Doctrine/common Component to 2.5.1 (security) (includes cache/annotations too)
Priority: Major » Critical

Since we agree, lets update the metadata. :)
It is critical as per the parent issue (minor updates are critical).

naveenvalecha’s picture

naveenvalecha
He/Him
Primary language Hindi
CreditAttribution: naveenvalecha as a volunteer and at QED42 commented

Closed #2493907: Update doctrine/collections to the latest stable release as duplicate.

Already mentioned to add me and iMiksu to commit credits in #14

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
CreditAttribution: webchick at Acquia commented
Status: Reviewed & tested by the community » Fixed

Committed and pushed to 8.0.x. Thanks!

  • webchick committed ca850b8 on 8.0.x 
    Issue #2105825 by cosmicdreams, larowlan, hussainweb, Nitesh Sethia,...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.