December 2018 - Security-news

JSON:API - Moderately critical - Access bypass - SA-CONTRIB-2018-081
by security-news＠drupal.org 19 Dec '18

19 Dec '18

View online: https://www.drupal.org/sa-contrib-2018-081 Project: JSON:API [1] Date: 2018-December-19 Security risk: *Moderately critical* 13∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module provides a JSON:API specification-compliant HTTP API for accessing and manipulating Drupal content and configuration entities. The module doesn't sufficiently check access when responding to certain filtered collection requests, thereby causing an access bypass vulnerability. In order to fix this issue, two new hooks were added: hook_jsonapi_ENTITY_TYPE_filter_access() and hook_jsonapi_entity_field_filter_access(). Sites with custom entity types and/or with entity or field access customizations may need to implement these newly introduced hooks. Solution: Install the latest version: * If you use the JSON:API module 8.x-1.x for Drupal 8.x, upgrade to JSON API 8.x-1.24 [3] Also see the JSON:API [4] project page. Reported By: * Gabe Sullice [5] * Lauri Eskola [6] Fixed By: * Gabe Sullice [7] * Wim Leers [8] * Alex Bronstein [9] of the Drupal Security Team * Tobias Zimmermann [10] * Andrei Mateescu [11] * Mateu Aguiló Bosch [12] * Hristo Chonov [13] * Daniel Wehner [14] * Sascha Grossenbacher [15] * Kristiaan Van den Eynde [16] * Lee Rowlands [17] of the Drupal Security Team Coordinated By: * Alex Bronstein [18] of the Drupal Security Team [1] https://www.drupal.org/project/jsonapi [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3021532 [4] https://www.drupal.org/project/jsonapi [5] https://www.drupal.org/user/2287430 [6] https://www.drupal.org/user/1078742 [7] https://www.drupal.org/user/2287430 [8] https://www.drupal.org/user/99777 [9] https://www.drupal.org/user/78040 [10] https://www.drupal.org/user/107158 [11] https://www.drupal.org/user/729614 [12] https://www.drupal.org/user/550110 [13] https://www.drupal.org/user/2901211 [14] https://www.drupal.org/user/99340 [15] https://www.drupal.org/user/214652 [16] https://www.drupal.org/user/1345130 [17] https://www.drupal.org/user/395439 [18] https://www.drupal.org/user/78040

1 0

E-Sign - Moderately critical - Cross site scripting - SA-CONTRIB-2018-080
by security-news＠drupal.org 19 Dec '18

19 Dec '18

View online: https://www.drupal.org/sa-contrib-2018-080 Project: E-Sign [1] Version: 7.x-1.9 Date: 2018-December-19 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module allows for integration of Signature Pad, an electronic-signing script, into Drupal for both nodes (content), the Field API (FAPI), and Webforms. The module doesn't sufficiently filter user input when displaying a signature. The vulnerability is mitigated by the fact that an attacker must have the ability to submit a signature. That permission might be associated with submitting a webform or creating or editing a node depending on site configuration. Solution: Install the latest version: * If you use the Esign module for Drupal 7.x, upgrade to Esign 7.x-1.10 [3] Also see the E-Sign [4] project page. Reported By: * Mitch Portier [5] Fixed By: * Adam Weiss [6] * Mitch Portier [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/esign [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/esign/releases/7.x-1.10 [4] https://www.drupal.org/project/esign [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/1199320 [7] https://www.drupal.org/user/2284182 [8] https://www.drupal.org/u/greggles

1 0

Responsive Menus - Moderately critical - Cross site scripting - SA-CONTRIB-2018-079
by security-news＠drupal.org 05 Dec '18

05 Dec '18

View online: https://www.drupal.org/sa-contrib-2018-079 Project: Responsive Menus [1] Version: 7.x-1.x-dev Date: 2018-December-05 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module enables you to collapse your sites main menu on mobile, and show a menu toggle button. The module doesn't sufficiently sanitize configuration settings provided by users which leads to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer responsive menus". Solution: Install the latest version: * If you use the responsive_menus module for Drupal 7.x, upgrade to responsive_menus 7.x-1.7 [3] Reported By: * Ayesh Karunaratne [4] Fixed By: * Joshua Walker [5] Coordinated By: * Michael Hess [6] of the Drupal Security Team * David Snopek [7] of the Drupal Security Team [1] https://www.drupal.org/project/responsive_menus [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/responsive_menus/releases/7.x-1.7 [4] https://www.drupal.org/user/796148 [5] https://www.drupal.org/user/433663 [6] https://www.drupal.org/u/mlhess [7] https://www.drupal.org/u/dsnopek

1 0

Salesforce Suite - Moderately critical - Access bypass - SA-CONTRIB-2018-078
by security-news＠drupal.org 05 Dec '18

05 Dec '18

View online: https://www.drupal.org/sa-contrib-2018-078 Project: Salesforce Suite [1] Date: 2018-December-05 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module enables Drupal to synchronize entities with Salesforce records. The module includes a page that does not sufficiently protect access rights, resulting in potential information disclosure. This vulnerability is mitigated by the fact that only Drupal entity title and IDs, and Salesforce record IDs are exposed. Entity content and metadata are appropriately protected. Disclosure of Salesforce ID does not confer any additional privileges. Solution: Install the latest version: * If you use the Salesforce Suite module for Drupal 8.x, upgrade to Salesforce Suite 8.x-3.1 [3] Also see the Salesforce Suite [4] project page. Reported By: * Oskar Schöldström [5] Fixed By: * Aaron Bauman [6] * Gabriel Carleton-Barnes [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/salesforce [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/salesforce/releases/8.x-3.1 [4] https://www.drupal.org/project/salesforce [5] https://www.drupal.org/user/799618 [6] https://www.drupal.org/user/384578 [7] https://www.drupal.org/user/1682976 [8] https://www.drupal.org/u/greggles

1 0

Password Policy - Less critical - Denial of Service - SA-CONTRIB-2018-077
by security-news＠drupal.org 05 Dec '18

05 Dec '18

View online: https://www.drupal.org/sa-contrib-2018-077 Project: Password Policy [1] Version: 7.x-1.x-dev Date: 2018-December-05 Security risk: *Less critical* 9∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] Vulnerability: Denial of Service Description: The Password Policy module makes it possible to set constraints on user passwords which disallow certain passwords. The "digit placement" constraint is vulnerable to Denial of Service attacks if an attacker submits specially crafted passwords which can cause a site to become unresponsive. This vulnerability is mitigated by the fact that a site must have the "digit placement" constraint enabled. Solution: Install the latest version: * If you use the Password Policy module for Drupal 7.x, upgrade to Password Policy 7.x-1.16 [3] Reported By: * Michael Sherron [4] Fixed By: * AohRveTPV [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * David Snopek [7] of the Drupal Security Team [1] https://www.drupal.org/project/password_policy [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/password_policy/releases/7.x-1.16 [4] https://www.drupal.org/user/470070 [5] https://www.drupal.org/user/2760115 [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/dsnopek

1 0