Hash: SHA256

             AUSCERT External Security Bulletin Redistribution

            Drupal 7 will reach end-of-life in November of 2021
                             26 February 2019


        AusCERT Security Bulletin Summary

Product:           Drupal 7
Publisher:         Drupal Security Team
Operating System:  Windows
                   UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Reduced Security -- Unknown/Unspecified
Resolution:        Patch/Upgrade

Original Bulletin: 

- --------------------------BEGIN INCLUDED TEXT--------------------

Date: 2019-February-25
Drupal 7
Vulnerability:  Drupal 7 will reach end-of-life in November of 2021

Drupal 7 was first released in January 2011. In November 2021, after over a
decade, Drupal 7 will reach end of life (EOL). (More information on why this
date was chosen [1].) Official community support for version 7 will end,
along with support provided by the Drupal Association on Drupal.org. This
means that automated testing services for Drupal 7 will be shut down, and
there will be no more updates provided by the Drupal Security Team.

When this occurs, Drupal 7 will be marked end-of-life in the update manager,
which appears in the Drupal administrative interface. Updates, security
fixes, and enhancements will no longer be provided by the community, but may
be available on a limited basis from select commercial vendors.

If you have a site that is running on Drupal 7, now is the time to start
planning the upgrade.  Note that the transition from Drupal 8 to Drupal 9
will not be the significant effort that the transition from 7 to 8 was. In
fact, the first release of Drupal 9 will be identical to the last release of
Drupal 8, except with deprecated code removed and dependencies updated to
newer versions. (See Plan for Drupal 9 [2] for more information on Drupal 9.)

What this means for your Drupal 7 sites is, as of November 2021:

   * Drupal 7 will no longer be supported by the community at large. The
     community at large will no longer create new projects, fix bugs in
     existing projects, write documentation, etc. around Drupal 7.
   * There will be no more core commits to Drupal 7.
   * The Drupal Security Team will no longer provide support or Security
     Advisories for Drupal 7 core or contributed modules, themes, or other
     projects. Reports about Drupal 7 vulnerabilities might become public
     creating 0 day exploits.
   * All Drupal 7 releases on all project pages will be flagged as not
     supported. Maintainers can change that flag if they desire to.
   * On Drupal 7 sites with the update status module, Drupal Core will show up
     as unsupported.
   * After November 2021, using Drupal 7 may be flagged as insecure in 3rd
     party scans as it no longer gets support.
   * Best practice is to not use unsupported software, it would not be
     advisable to continue to build new Drupal 7 sites.
   * Now is the time to start planning your migration to Drupal 8.

If, for any reason, you are unable to migrate to Drupal 8 or 9 by the time
version 7 reaches end of life, there will be a select number of organizations
that will provide Drupal 7 Vendor Extended Support (D7ES) for their paying
clients.  This program is the successor to the successful Drupal 6 LTS
program. Like that program, it will be an additional paid service, fully
operated by these organizations with some help from the Security Team.

The Drupal Association and Drupal Security Team will publish an announcement
once we have selected the Drupal 7 Vendor Extended Support partners.

If you would like more information about the Drupal release cycle, consult
the official documentation on Drupal.org. If you would like more information
about the upcoming release of Drupal 9, join us at DrupalCon Seattle.

.... Information for organizations interested in providing commercial Drupal
       7 Vendor Extended Support

Organizations interested in providing commercial Drupal 7 Vendor Extended
Support to their customers *and* who have the technical knowledge to maintain
Drupal 7 are invited to fill out the
application for the Drupal 7 Vendor Extended Support team [3]. The
application submission should explain why the vendor is a good fit for the
program, and explain how they meet the requirements as outlined below.

Base requirements for this program include:

   * You must have experience in the public issue queue supporting Drupal 7
     core or Drupal 7 Modules.  You should be able to point to a history of
     such contribution.  One way to measure this is issue credits, but there
     are other ways.   You must continue this throughout your enrollment in 
     the program.  If you have other ways to show your experience, feel free to
     highlight them.
   * You must make a commitment to the Security Team, the Drupal Association,
     and your customers that you will remain active in this program for 3
   * As a partner, you must contribute to at least 20% of all Drupal 7 Vendor
     Extended Support module patches and 80% of D7ES core patches in a given
     year. (Modules that have been moved into core in Drupal 8 count as part of
     core metrics in Drupal 7) .
   * Any organization involved in this program must have at least 1 member on
     the Drupal Security Team for at least 3 months prior to joining the
     program and while a member of the program.  (See How to join the Drupal
     Security Team [4] for information.) This person will need a positive
     evaluation of their contributions from the Security Working Group.
   * Payment of an Drupal 7 Vendor Extended Support annual fee for program
     participation is required (around $3000 a year). These fees will go to
     communication tools for the Drupal 7 Vendor Extended Support vendors
     and/or the greater community.
   * Payment of a $450 application fee is required.
   * Your company must provide paid support to Drupal 7 clients.  This program
     is not for companies that don't provide services to external clients.
Application review process:

   1) We will confirm that each vendor meets the requirements outlined above
      and is a good fit for the program.
   2) If the Security Working Group does not think you are a good fit, we will
      explain why and decline your application. If you are rejected, you are
      able to reapply.  Most rejections will be due to Organizations not 
      enough ongoing contribution to  Drupal 7 and Organizations not having a
      Drupal Security Team member at their organization.
   3) The Drupal Association signs off on your participation in the program.
   4) If you are accepted, you will be added to the Drupal 7 Vendor Extended
      Support vendor mailing list.
   5) The Security Working Group will do a coordinated announcement with the
      vendors to promote the program.

If you have any questions you can email d7es at drupal.org

[1] https://www.drupal.org/blog/drupal-7-8-and-9
[2] https://www.drupal.org/blog/plan-for-drupal-9
[3] https://www.surveymonkey.com/r/D7ES
[4] https://www.drupal.org/drupal-security-team/how-to-join-the-drupal-security-team

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
Comment: http://www.auscert.org.au/render.html?it=1967