4

Telerik recently announced that there is a security vulnerability with all versions of Telerik.Web.UI.dll assembly prior to 2017.2.621.

Sitecore includes documentation on how to secure Telerik for Sitecore 8.x (edit: note that the article referenced in the accepted answer provides better information than this one), but there appears to be no documentation for earlier versions.

On Sitecore 7.2 is there any issue with following the same guidelines as those for 8.x? Those would be removing these six lines from the web.config of content delivery environments:

<add name="Telerik_Web_UI_DialogHandler_aspx" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.DialogHandler.aspx" type="Telerik.Web.UI.DialogHandler" />
<add name="Telerik_Web_UI_SpellCheckHandler_axd" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.SpellCheckHandler.axd" type="Telerik.Web.UI.SpellCheckHandler" />
<add name="Telerik_Web_UI_WebResource_axd" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.WebResource.axd" type="Telerik.Web.UI.WebResource" />

<add verb="*" path="Telerik.Web.UI.DialogHandler.aspx" type="Telerik.Web.UI.DialogHandler" />
<add verb="*" path="Telerik.Web.UI.SpellCheckHandler.axd" type="Telerik.Web.UI.SpellCheckHandler" />
<add verb="*" path="Telerik.Web.UI.WebResource.axd" type="Telerik.Web.UI.WebResource" />

It would also include adding a new app setting:

<add key="Telerik.AsyncUpload.ConfigurationEncryptionKey" value="STRONG-RANDOM-VALUE-UNIQUE-TO-YOUR-APP" />

Or do earlier versions of Sitecore require the Telerik UI controls for content delivery environments?

1
  • 2
    A hotfix will be made available for earlier versions. No timeline announced, but expect it soon. And no, only mastering environments need Telerik controls.
    – Mark Cassidy
    Jun 30 '17 at 19:59
3

Sitecore has now released the official fix for the Telerik vulnerability, it can be found at https://kb.sitecore.net/articles/978654.

The knowledge base article provides steps for fixing versions 6.6–8.2; the only other impacted version is 6.5, for which Sitecore has not released a fix, but recommends upgrading to a later version.

2

You should be able to follow the 8.x updates for previous version of Sitecore as the changes are not Sitecore specific.

The Telerik controls are only used for the authoring of content (Rich Text Editor for example), so they are not needed on a Content Delivery server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.