Last week, researcher Fernando Arnaboldi from security firm IOActive disclosed several issues with the update mechanism in Drupal: the failure of the back-end administration panel to report update errors, a cross-site request forgery (CSRF) flaw that could allow attackers to force admins to repeatedly trigger update checks, and the lack of encryption for update downloads.
The last issue was the most significant one, because it could have allowed attackers who could intercept the traffic between a Drupal-based site and the official Drupal servers, to inject back-doored updates. Such an attack could lead to the compromise of the site and its database.
Fortunately, the Drupal security team was notified in advance and is working to fix the update shortcomings. Over the past few days the team has switched the project's infrastructure to support HTTPS so that the update processes for the Drupal core and its modules use secure channels.
For now the team has enabled HTTPS updates in Drush, a popular command-line shell and scripting interface for Drupal. It has also switched all download links from the project's pages to HTTPS.
The core update status module still doesn't use secure transport, but this is being worked on and will be deployed in the next Drupal update, the security team said in a blog post.
For now, website administrators can use a supported version of Drush to deploy updates or can manually download the release archives from their corresponding project pages.
The failed update notification issue and the CSRF flaw have not been addressed yet, but the Drupal security team opened tracking tickets for them and asked developers to contribute patches.