November 2019 - Security-news

Bugsnag - Critical - Unsupported - SA-CONTRIB-2019-081
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-081 Project: Bugsnag [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/bugsnag [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Noggin - Critical - Unsupported - SA-CONTRIB-2019-080
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-080 Project: Noggin [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/noggin [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Bypass Form Validations - Critical - Unsupported - SA-CONTRIB-2019-079
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-079 Project: Bypass Form Validations [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/bypass_form_validations [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Administration Views - Critical - Unsupported - SA-CONTRIB-2019-076
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-076 Project: Administration Views [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/admin_views [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Nexus Theme - Critical - Unsupported - SA-CONTRIB-2019-078
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-078 Project: Nexus Theme [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/nexus [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Frequently Asked Questions - Critical - Unsupported - SA-CONTRIB-2019-077
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-077 Project: Frequently Asked Questions [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/faq [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Open Social - Critical - Insecure Session Management - SA-CONTRIB-2019-075
by security-news＠drupal.org 06 Nov '19

06 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-075 Project: Open Social [1] Date: 2019-November-06 Security risk: *Critical* 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Insecure Session Management Description: Open Social is a Drupal distribution for online communities. The included social_magic_login module doesn't sufficiently validate magic login URLs for user accounts that do not have a local password, but login via external systems. The lack of validation makes it possible for an adversary to forge valid login URLs and login to such an account. This vulnerability is mitigated by the fact the module social_magic_login needs to be enabled. Solution: Install the latest version: * If you use the Open Social distribution for Drupal 8.x-7.x, upgrade to open social 8.x-7.1 [3] * If you use the Open Social distribution for Drupal 8.x-6.x, upgrade to open social 8.x-6.5 [4] Alternatively, disable the module social_magic_login. Also see the Open Social [5] project page. Reported By: * Heine [6] of the Drupal Security Team Fixed By: * Heine [7] of the Drupal Security Team * Alexander Varwijk [8] * Ronald te Brake [9] * Drew Webber [10] of the Drupal Security Team Coordinated By: * Heine [11] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/8.x-7.1 [4] https://www.drupal.org/project/social/releases/8.x-6.5 [5] https://www.drupal.org/project/social [6] https://www.drupal.org/user/17943 [7] https://www.drupal.org/user/17943 [8] https://www.drupal.org/user/1868952 [9] https://www.drupal.org/user/2314038 [10] https://www.drupal.org/user/255969 [11] https://www.drupal.org/user/17943

1 0