March 2018 - Security-news - lists.drupal.org

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002
by security-news＠drupal.org 28 Mar '18

28 Mar '18

View online: https://www.drupal.org/sa-core-2018-002 Project: Drupal core [1] Date: 2018-March-28 Security risk: *Highly critical* 21∕25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Remote Code Execution Description: CVE: CVE-2018-7600 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. The security team has written an FAQ [3] about this issue. Solution: Upgrade to the most recent version of Drupal 7 or 8 core. * *If you are running 7.x, upgrade to Drupal 7.58 [4].* (If you are unable to update immediately, you can attempt to apply this patch [5] to fix the vulnerability until such time as you are able to completely update.) * *If you are running 8.5.x, upgrade to Drupal 8.5.1 [6].* (If you are unable to update immediately, you can attempt to apply this patch [7] to fix the vulnerability until such time as you are able to completely update.) Drupal 8.3.x and 8.4.x are no longer supported and we don't normally provide security releases for unsupported minor releases [8]. However, given the potential severity of this issue, we /are/ providing 8.3.x and 8.4.x releases that includes the fix for sites which have not yet had a chance to update to 8.5.0. Your site's update report page will recommend the 8.5.x release even if you are on 8.3.x or 8.4.x. Please take the time to update to a supported version after installing this security update. * If you are running 8.3.x, upgrade to Drupal 8.3.9 [9] or apply this patch [10]. * If you are running 8.4.x, upgrade to Drupal 8.4.6 [11] or apply this patch [12]. This issue also affects Drupal 8.2.x and earlier, which are no longer supported. If you are running any of these versions of Drupal 8, update to a more recent release and then follow the instructions above. This issue also affects Drupal 6. Drupal 6 is End of Life. For more information on Drupal 6 support please contact a D6LTS vendor [13]. Reported By: * Jasper Mattsson [14] Fixed By: * Jasper Mattsson [15] * Samuel Mortenson [16] Provisional Drupal Security Team member * David Rothstein [17] of the Drupal Security Team * Jess (xjm) [18] of the Drupal Security Team * Michael Hess [19] of the Drupal Security Team * Lee Rowlands [20] of the Drupal Security Team * Peter Wolanin [21] of the Drupal Security Team * Alex Pott [22] of the Drupal Security Team * David Snopek [23] of the Drupal Security Team * Pere Orga [24] of the Drupal Security Team * Neil Drumm [25] of the Drupal Security Team * Cash Williams [26] of the Drupal Security Team * Daniel Wehner [27] * Tim Plunkett [28] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached by email at security at drupal.org or via the contact form. Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site. [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://groups.drupal.org/security/faq-2018-002 [4] https://www.drupal.org/project/drupal/releases/7.58 [5] https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=2266d2a83db50e2f97682d… [6] https://www.drupal.org/project/drupal/releases/8.5.1 [7] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [8] https://www.drupal.org/core/release-cycle-overview [9] https://www.drupal.org/project/drupal/releases/8.3.9 [10] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [11] https://www.drupal.org/project/drupal/releases/8.4.6 [12] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [13] https://www.drupal.org/project/d6lts [14] https://www.drupal.org/u/Jasu_M [15] https://www.drupal.org/u/Jasu_M [16] https://www.drupal.org/user/2582268 [17] https://www.drupal.org/user/124982 [18] https://www.drupal.org/user/65776 [19] https://www.drupal.org/user/102818 [20] https://www.drupal.org/u/larowlan [21] https://www.drupal.org/user/49851 [22] https://www.drupal.org/u/alexpott [23] https://www.drupal.org/u/dsnopek [24] https://www.drupal.org/u/pere-orga [25] https://www.drupal.org/u/drumm [26] https://www.drupal.org/u/cashwilliams [27] https://www.drupal.org/u/dawehner [28] https://www.drupal.org/u/tim.plunkett

1 0

Drupal 7 and 8 core critical release on March 28th, 2018 PSA-2018-001
by security-news＠drupal.org 21 Mar '18

21 Mar '18

View online: https://www.drupal.org/psa-2018-001 * Advisory ID: DRUPAL-PSA-2018-001 * Project: Drupal Core * Version: 7.x, 8.x * Date: 2018-March-21 -------- DESCRIPTION --------------------------------------------------------- There will be a security release of *Drupal 7.x, 8.3.x, 8.4.x, and 8.5.x on March 28th 2018 between 18:00 - 19:30 UTC*, one week from the publication of this document, that will fix a highly critical security vulnerability. The Drupal Security Team urges you to reserve time for core updates at that time because exploits /might/ be developed within hours or days. Security release announcements will appear on the Drupal.org security advisory page [1]. While Drupal 8.3.x and 8.4.x are no longer supported and we don't normally provide security releases for unsupported minor releases [2], given the potential severity of this issue, we /are/ providing 8.3.x and 8.4.x releases that includes the fix for sites which have not yet had a chance to update to 8.5.0. The Drupal security team strongly recommends the following: * Sites on 8.3.x should immediately update to the 8.3.x release that will be provided in the advisory, and then plan to update to the latest 8.5.x security release in the next month. * Sites on 8.4.x should immediately update to the 8.4.x release that will be provided in the advisory, and then plan to update to the latest 8.5.x security release in the next month. * Sites on 7.x or 8.5.x can immediately update when the advisory is released using the normal procedure. The security advisory will list the appropriate version numbers for all three Drupal 8 branches. Your site's update report page will recommend the 8.5.x release even if you are on 8.3.x or 8.4.x, but temporarily updating to the provided backport for your site's current version will ensure you can update quickly without the possible side effects of a minor version update. The Security Team or any other party is not able to release any more information about this vulnerability until the announcement is made. The announcement will be made public at www.drupal.org/security [3], over Twitter, and in email for those who have subscribed to our email list. To subscribe to the email list: log in on drupal.org, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab. Journalists interested in covering the story are encouraged to email security-press(a)drupal.org to be sure they will get a copy of the journalist-focused release. The Security Team will release a journalist-focused summary email at the same time as the new code release and advisory. If you find a security issue, please report it at https://www.drupal.org/security-team/report-issue [4]. [1] https://www.drupal.org/security [2] https://www.drupal.org/core/release-cycle-overview [3] www.drupal.org/security [4] https://www.drupal.org/security-team/report-issue

1 0

JSON API - Moderately critical - Access Bypass - SA-CONTRIB-2018-016
by security-news＠drupal.org 21 Mar '18

21 Mar '18

View online: https://www.drupal.org/sa-contrib-2018-016 Project: JSON API [1] Version: 8.x-1.x-dev Date: 2018-March-21 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access Bypass Description: This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. The module doesn't sufficiently check access when viewing related resources or relationships, thereby causing an access bypass vulnerability. This vulnerability is mitigated by the fact that an attacker must be allowed to view the related data, otherwise all they can glean is an entity type UUID and a UUID, which are meaningless by themselves. Solution: Install the latest version: * If you use the JSON API module for Drupal 8.x, upgrade to JSON API 8.x-1.14 [3] Reported By: * Gabe Sullice [4] Fixed By: * Wim Leers [5] * Mateu Aguiló Bosch [6] Coordinated By: * Michael Hess [7] Of the Drupal Security Team [1] https://www.drupal.org/project/jsonapi [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/jsonapi/releases/8.x-1.14 [4] https://www.drupal.org/user/2287430 [5] https://www.drupal.org/user/99777 [6] https://www.drupal.org/user/550110 [7] https://www.drupal.org/u/mlhess

1 0

Exif - Critical - Access bypass - SA-CONTRIB-2018-017
by security-news＠drupal.org 21 Mar '18

21 Mar '18

View online: https://www.drupal.org/sa-contrib-2018-017 Project: Exif [1] Version: 8.x-1.x-dev Date: 2018-March-21 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables you to retrieve image metadata and use them in fields or title. The module doesn't sufficiently restrict access to module setting pages thereby causing an access bypass vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission to create entities of certain content entity types. Solution: Install the latest version: * If you use the Exif module for Drupal 8.x, upgrade to Exif 8.x-1.1 [3] Reported By: * Jean-Francois Hovinne [4] Fixed By: * jphautin [5] * Jean-Francois Hovinne [6] Coordinated By: * Damien McKenna [7] [1] https://www.drupal.org/project/exif [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/exif/releases/8.x-1.1 [4] https://www.drupal.org/user/77723 [5] https://www.drupal.org/user/534338 [6] https://www.drupal.org/user/77723 [7] https://www.drupal.org/user/108450

1 0