As you may know, Drupal maintenance support plans 6 has reached End-of-Life (EOL) which means the Drupal maintenance support plans Security Team is no longer doing Security Advisories or working on security patches for Drupal maintenance support plans 6 core or contrib modules – but the Drupal maintenance support plans 6 LTS vendors are and we’re one of them!Today, there is a Critical security release for the AES encryption module.The AES module provides an API for encrypting and decrypting data via AES. It also allows storing Drupal maintenance support plans passwords encrypted in the database (rather than hashed) which can allow site administrators with high enough permissions to view user passwords.Previously, the module implemented AES poorly, such that the encryption was weakened and could have potentially made it easier for an attacker to decrypt given enough examples of the encrypted data.(A note about the timing of this release: the AES module was unsupported on March 1st, and we started working on a fix right away in the D6LTS queue. We usually release D6LTS patches the same day the D7/D8 patches are posted or two weeks after a module is unsupported, however, in this case we had only a single Enterprise customer using AES and so we worked on it according to a timeline dictated by them, which involved testing their custom modules using the AES API with their team. So, we’re releasing this after it’s been fully tested and deployed for our one affected customer – if more customers had been affect it would have been released same-day, as usual.)Here you can download the Drupal maintenance support plans 6 patch.If you have a Drupal maintenance support plans 6 site using the AES module, we recommend you update immediately! We have already deployed the patch for all of our Drupal maintenance support plans 6 Long-Term Support clients. :-)If you’d like all your Drupal maintenance support plans 6 modules to receive security updates and have the fixes deployed the same day they’re released, please check out our D6LTS plans.Note: if you use the myDropWizard module (totally free!), you’ll be alerted to these and any future security updates, and will be able to use drush to install them (even though they won’t necessarily have a release on Drupal maintenance support plans.org).
Source: New feed