July 2018 - Security-news - lists.drupal.org

Drupal 8 release on August 1st, 2018 - DRUPAL-PSA-2018-07-30
by security-news＠drupal.org 30 Jul '18

30 Jul '18

View online: https://www.drupal.org/psa-2018-07-30 The Drupal Security Team will be coordinating a security release for Drupal 8 this week on Wednesday, August 1, 2018. (We are issuing this PSA in advance because the in the regular security release window schedule [1], August 1 would not typically be a core security window.) The Drupal 8 core release will be made between noon and 3pm EDT. It is rated as moderately critical. The core release will be an update to a vendor library only. August 1 also remains a normal security release window for contributed projects. [1] https://www.drupal.org/node/1173280

1 0

Select (or other) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-054
by security-news＠drupal.org 25 Jul '18

25 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-054 Project: Select (or other) [1] Date: 2018-July-25 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables users to select 'other' on certain form elements and a textfield appears for the user to provide a custom value. The module doesn't sufficiently escape values of a text field the under the scenario when "Select or other" formatter is used. This vulnerability is mitigated by the fact that an attacker must have access to edit a field that is displayed through the "Select or other" formatter. Solution: * If you use the "Select or other" 7.x-2.x, upgrade to Select or other 7.x-2.24 [3] * If you use the "Select or other" 7.x-3.x, upgrade to Select or other 7.x-3.0-alpha3 [4] Also see the Select (or other) [5] project page. Reported By: * bucefal91 [6] Fixed By: * Chris Jansen [7], the module maintainer Coordinated By: * Michael Hess [8] of the Drupal Security Team [1] https://www.drupal.org/project/select_or_other [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/select_or_other/releases/7.x-2.24 [4] https://www.drupal.org/project/select_or_other/releases/7.x-3.0-alpha3 [5] https://www.drupal.org/project/select_or_other [6] https://www.drupal.org/user/504128 [7] https://www.drupal.org/user/2480548 [8] https://www.drupal.org/u/mlhess

1 0

XML sitemap - Moderately critical - Information Disclosure - SA-CONTRIB-2018-053
by security-news＠drupal.org 18 Jul '18

18 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-053 Project: XML sitemap [1] Date: 2018-July-18 Security risk: *Moderately critical* 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information Disclosure Description: This module enables you to generate XML sitemaps and it helps search engines to more intelligently crawl a website and keep their results up to date. The module doesn't sufficiently handle access rights under the scenario of updating contents from cron execution. Solution: * If you use the XML sitemap module for Drupal 7.x, upgrade to XML sitemap 7.x-2.4 [3] Also see the XML sitemap [4] project page. Reported By: * Balazs Janos Tatar [5] Provisional Security Team member Fixed By: * Balazs Janos Tatar [6] * jtsnow [7] * Tushar Thatikonda [8] Coordinated By: * Michael Hess [9] of the Drupal Security Team [1] https://www.drupal.org/project/xmlsitemap [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/2986578 [4] https://www.drupal.org/project/xmlsitemap [5] https://www.drupal.org/user/649590 [6] https://www.drupal.org/user/649590 [7] https://www.drupal.org/user/171614 [8] https://www.drupal.org/user/1835276 [9] https://www.drupal.org/u/mlhess

1 0

Taxonomy Entity Queue - Critical - SQL Injection - SA-CONTRIB-2018-052
by security-news＠drupal.org 18 Jul '18

18 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-052 Project: Taxonomy Entity Queue [1] Date: 2018-July-18 Security risk: *Critical* 17∕25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: SQL Injection Description: This module enables you to create an entityqueue based on a taxonomy. The module did not properly use Drupal's database API when querying the database with user supplied values, allowing an attacker to send a specially crafted request to modify the query or potentially perform additional queries. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer entity queue taxonomy" permission. Solution: Install the latest version: * If you use the Taxonomy Entity Queue module for Drupal 7.x, upgrade to Taxonomy Entity Queue 7.x-1.1 [3] Also see the Taxonomy Entity Queue [4] project page. Reported By: * Drew Webber [5] Fixed By: * Bappa Sarkar [6] * Drew Webber [7] Coordinated By: * Michael Hess [8] of the Drupal Security Team [1] https://www.drupal.org/project/entityqueue_taxonomy [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entityqueue_taxonomy/releases/7.x-1.1 [4] https://www.drupal.org/project/entityqueue_taxonomy [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/262655 [7] https://www.drupal.org/user/255969 [8] https://www.drupal.org/u/mlhess

1 0

Commerce Custom Order Status - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-046
by security-news＠drupal.org 11 Jul '18

11 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-046 Project: Commerce Custom Order Status [1] Date: 2018-July-11 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: Commerce Custom Order Status provides forms for administrators to add, edit, and delete order statuses from the order settings screen. The module doesn't sufficiently sanitize the output of the status names. This vulnerability is mitigated by the fact that an attacker must have a role with the "configure order settings" permission. Solution: Install the latest version: * If you use the Commerce Custom Order Status module for Drupal 7.x, upgrade to Commerce Custom Order Status 7.x-1.1 [3] Also see the Commerce Custom Order Status [4] project page. Reported By: * bucefal91 [5] Fixed By: * bucefal91 [6] * Fabien Leroux [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/commerce_custom_order_status [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_custom_order_status/releases/7.x-1.1 [4] https://www.drupal.org/project/commerce_custom_order_status [5] https://www.drupal.org/user/504128 [6] https://www.drupal.org/user/504128 [7] https://www.drupal.org/user/407852 [8] https://www.drupal.org/u/greggles

1 0

Tapestry - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-051
by security-news＠drupal.org 11 Jul '18

11 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-051 Project: Tapestry [1] Date: 2018-July-11 Security risk: *Moderately critical* 14∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: This theme provides Drupal users with many advanced features including 20 Different Color Styles, 30 User Regions, Custom Block Theme Templates, Suckerfish Menus, Icon Support, Advanced Page Layout Options, Simple Configuration, Custom Typography... The theme doesn't sufficiently sanitize user input. This vulnerability is mitigated by the fact that the theme is only exploitable with non-default settings and under certain site configurations. Solution: Install the latest version: * If you use the Tapestry theme for Drupal 7.x, upgrade to Tapestry 7.x-2.2 [3] Also see the Tapestry [4] project page. Reported By: * Drew Webber [5] Fixed By: * Kisugi Ai [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team [1] https://www.drupal.org/project/tapestry [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tapestry/releases/7.x-2.2 [4] https://www.drupal.org/project/tapestry [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/1284976 [7] https://www.drupal.org/u/mlhess

1 0

litejazz - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-050
by security-news＠drupal.org 11 Jul '18

11 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-050 Project: litejazz [1] Date: 2018-July-11 Security risk: *Moderately critical* 14∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: This theme features 3 color styles, 12 fully collapsible regions, suckerfish menus, fluid or fixed widths, easy configuration, and more. The theme doesn't sufficiently sanitize user input. This vulnerability is mitigated by the fact that the theme is only exploitable with non-default settings and under certain site configurations. Solution: Install the latest version: * If you use the litejazz theme for Drupal 7.x, upgrade to litejazz 7.x-2.3 [3] Also see the litejazz [4] project page. Reported By: * Drew Webber [5] Fixed By: * Kisugi Ai [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team [1] https://www.drupal.org/project/litejazz [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/litejazz/releases/7.x-2.3 [4] https://www.drupal.org/project/litejazz [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/1284976 [7] https://www.drupal.org/u/mlhess

1 0

NewsFlash - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-049
by security-news＠drupal.org 11 Jul '18

11 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-049 Project: NewsFlash [1] Date: 2018-July-11 Security risk: *Moderately critical* 14∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: This theme features 7 color styles, 12 collapsible regions, suckerfish menus, fluid or fixed widths, and lots more. The theme doesn't sufficiently sanitize user input. This vulnerability is mitigated by the fact that the theme is only exploitable with non-default settings and under certain site configurations. Solution: Install the latest version: * If you use the NewsFlash theme for Drupal 7.x, upgrade to NewsFlash 7.x-2.6 [3] Also see the NewsFlash [4] project page. Reported By: * Drew Webber [5] Fixed By: * Kisugi Ai [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team [1] https://www.drupal.org/project/newsflash [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/newsflash/releases/7.x-2.6 [4] https://www.drupal.org/project/newsflash [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/1284976 [7] https://www.drupal.org/u/mlhess

1 0

Beale Street - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-048
by security-news＠drupal.org 11 Jul '18

11 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-048 Project: Beale Street [1] Date: 2018-July-11 Security risk: *Moderately critical* 13∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: This theme features 4 built-in color styles, 18 collapsible regions, Suckerfish menus, flexible widths, adjustable sidebars, configurable font family, and lots more. The theme doesn't sufficiently sanitize user input. This vulnerability is mitigated by the fact that the theme is not exploitable under common site configurations. Solution: * If you use the Beale Street theme for Drupal 7.x, upgrade to Beale Street 7.x-1.2 [3] Also see the Beale Street [4] project page. Reported By: * Drew Webber [5] Fixed By: * Kisugi Ai [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team [1] https://www.drupal.org/project/bealestreet [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/bealestreet/releases/7.x-1.2 [4] https://www.drupal.org/project/bealestreet [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/1284976 [7] https://www.drupal.org/u/mlhess

1 0

EU Cookie Compliance - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-047
by security-news＠drupal.org 11 Jul '18

11 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-047 Project: EU Cookie Compliance [1] Date: 2018-July-11 Security risk: *Moderately critical* 12∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description: This module addresses the General Data Protection Regulation (GDPR) that came into effect 25th May 2018, and the EU Directive on Privacy and Electronic Communications from 2012. It provides a banner where you can gather consent from the user to store cookies on their computer and handle their personal information. This module does not sanitize some inputs leading to XSS. This is mitigated by the attacker having the permission "Administer EU Cookie Compliance." Solution: Install the latest version: * If you use the eu_cookie_compliance module for Drupal 7.x, upgrade to eu_cookie_compliance 7.x-1.24 [3] * If you use the eu_cookie_compliance module for Drupal 8.x, upgrade to eu_cookie_compliance 8.x-1.1 [4] Also see the EU Cookie Compliance [5] project page. Reported By: * Alexander Hass [6] Fixed By: * Sven Berg Ryen [7] Coordinated By: * Michael Hess [8] of the Drupal Security Team [1] https://www.drupal.org/project/eu_cookie_compliance [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/eu_cookie_compliance/releases/7.x-1.24 [4] https://www.drupal.org/project/eu_cookie_compliance/releases/8.x-1.1 [5] https://www.drupal.org/project/eu-cookie-compliance [6] https://www.drupal.org/user/85918 [7] https://www.drupal.org/user/667244 [8] https://www.drupal.org/u/mlhess

1 0