Security-news February 2019

security-news@drupal.org

1 participants
23 discussions

Facets - Moderately critical - Cross site scripting - SA-CONTRIB-2019-030
by security-news＠drupal.org 27 Feb '19

27 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-030 Project: Facets [1] Version: 8.x-1.x-dev Date: 2019-February-27 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross site scripting Description: This module enables you to create facet-filters for results of a search query and exposes them as blocks The module doesn't sufficiently escape HTML under the scenario leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by two factors. First, an attacker must have a way to insert results in the dataset that is exposed as a facet before this can happen. The permission to inject malicious strings depends on the site's search configuration but could be available to any user who can create content in a site. Second, the site must be using the Javascript-based dropdown widget. Solution: * Install the latest version Facets 8.x-1.3 [3] An effective mitigation is to change the widget to use links instead of the dropdown widget. Reported By: * Ide Braakman [4] Fixed By: * Jimmy Henderickx [5] * Joris Vercammen [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/facets [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/facets/releases/8.x-1.3 [4] https://www.drupal.org/user/1879760 [5] https://www.drupal.org/user/462700 [6] https://www.drupal.org/user/2393360 [7] https://www.drupal.org/user/36762

1 0

Rabbit Hole - Moderately critical - Access bypass - SA-CONTRIB-2019-029
by security-news＠drupal.org 27 Feb '19

27 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-029 Project: Rabbit Hole [1] Version: 7.x-2.x-dev Date: 2019-February-27 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: The Rabbit Hole module allows administrators to control what should happen when a regular user tries to view an entity at its own page; for example, it may deliver a 403 Access Denied or 404 Page Not Found response, or redirect the user to another path. The module doesn't respect the Rabbit Hole settings when an entity is being requested with a certain header. This could lead to certain data being exposed even if it shouldn't be. The vulnerability is mitigated by the fact that the user also needs permission to view the content being requested. Solution: Install version 7.x-2.25, available at https://www.drupal.org/project/rabbit_hole/releases/7.x-2.25 [3]. Reported By: * Fabian Iwand [4] Fixed By: * Fabian Iwand [5] * M Parker [6] * Olof Bokedal [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/rabbit_hole [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/rabbit_hole/releases/7.x-2.25 [4] https://www.drupal.org/user/1632364 [5] https://www.drupal.org/user/1632364 [6] https://www.drupal.org/user/536298 [7] https://www.drupal.org/user/1198438 [8] https://www.drupal.org/user/36762

1 0

Context - Moderately critical - Cross site scripting - SA-CONTRIB-2019-028
by security-news＠drupal.org 27 Feb '19

27 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-028 Project: Context [1] Version: 7.x-3.x-dev Date: 2019-February-27 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module enables you to manage contextual conditions and reactions for different portions of your site. The module doesn't sufficiently sanitize user output when displayed leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have the ability to store malicious markup in the site (e.g. permission to create a node with a field that accepts "filtered html"). Solution: Install the latest version: * If you use the context module for Drupal 7.x, upgrade to context 7.x-3.10 [3] Also see the Context [4] project page. Reported By: * poiu [5] Fixed By: * Bostjan Kovac [6] Coordinated By: * Ivo Van Geertruyen [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team * Cash Williams [9] of the Drupal Security Team [1] https://www.drupal.org/project/context [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/context/releases/7.x-3.10 [4] https://www.drupal.org/project/context [5] https://www.drupal.org/user/194009 [6] https://www.drupal.org/user/1773456 [7] https://www.drupal.org/user/383424 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/29938

1 0

Path Breadcrumbs - Moderately critical - Cross site scripting - SA-CONTRIB-2019-027
by security-news＠drupal.org 27 Feb '19

27 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-027 Project: Path Breadcrumbs [1] Version: 7.x-3.x-dev Date: 2019-February-27 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module enables you to configure breadcrumbs for any Drupal page. This module doesn't properly sanitize custom breadcrumb configuration in all cases, leading to an XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer Path Breadcrumbs". Solution: Install the latest version: * Upgrade to Path Breadcrumbs 7.x-3.4 [3] Also see the Path Breadcrumbs [4] project page. Reported By: * poiu [5] Fixed By: * Kate Marshalkina [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/path_breadcrumbs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/path_breadcrumbs/releases/7.x-3.4 [4] https://www.drupal.org/project/path_breadcrumbs [5] https://www.drupal.org/user/194009 [6] https://www.drupal.org/user/1399638 [7] https://www.drupal.org/user/36762

1 0

Services - Critical - SQL Injection - SA-CONTRIB-2019-026
by security-news＠drupal.org 27 Feb '19

27 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-026 Project: Services [1] Version: 7.x-3.x-dev Date: 2019-February-27 Security risk: *Critical* 19∕25 AC:None/A:None/CI:All/II:Some/E:Theoretical/TD:Default [2] Vulnerability: SQL Injection Description: This module provides a standardized solution for building API's so that external clients can communicate with Drupal. The module doesn't sufficiently sanitize user input for entity index resources thus allowing SQL Injection attacks. This vulnerability is mitigated by the fact that the Drupal 7 site must have an "index" resource(s) enabled under the Services endpoint configuration (admin/structure/services/list/MY-ENDPOINT/resources) and an attacker must know the endpoint's machine name. Install the 7.x-3.22 [3] version of the Services module for the fix, or simply disable any "index" resources to stop the attack vector. Solution: Install the latest version: * If you use the 7.x-3.x Services module for Drupal, upgrade to Services 7.x-3.22 [4] Reported By: * Samuel Mortenson [5] of the Drupal Security Team Fixed By: * Tyler Frankenstein [6] * Samuel Mortenson [7] of the Drupal Security Team * Ivo Van Geertruyen [8] of the Drupal Security Team Coordinated By: * Samuel Mortenson [9] of the Drupal Security Team [1] https://www.drupal.org/project/services [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/services/releases/7.x-3.22 [4] https://www.drupal.org/project/services/releases/7.x-3.22 [5] https://www.drupal.org/user/2582268 [6] https://www.drupal.org/user/150680 [7] https://www.drupal.org/user/2582268 [8] https://www.drupal.org/user/383424 [9] https://www.drupal.org/user/2582268

1 0

Drupal 7 will reach end-of-life in November of 2021 - PSA-2019-02-25
by security-news＠drupal.org 25 Feb '19

25 Feb '19

View online: https://www.drupal.org/psa-2019-02-25 Date: 2019-February-25 Vulnerability: Drupal 7 will reach end-of-life in November of 2021 Description: Drupal 7 was first released in January 2011. In November 2021, after over a decade, Drupal 7 will reach end of life (EOL). (More information on why this date was chosen [1].) Official community support for version 7 will end, along with support provided by the Drupal Association on Drupal.org. This means that automated testing services for Drupal 7 will be shut down, and there will be no more updates provided by the Drupal Security Team. When this occurs, Drupal 7 will be marked end-of-life in the update manager, which appears in the Drupal administrative interface. Updates, security fixes, and enhancements will no longer be provided by the community, but may be available on a limited basis from select commercial vendors. If you have a site that is running on Drupal 7, now is the time to start planning the upgrade. Note that the transition from Drupal 8 to Drupal 9 will not be the significant effort that the transition from 7 to 8 was. In fact, the first release of Drupal 9 will be identical to the last release of Drupal 8, except with deprecated code removed and dependencies updated to newer versions. (See Plan for Drupal 9 [2] for more information on Drupal 9.) What this means for your Drupal 7 sites is, as of November 2021: * Drupal 7 will no longer be supported by the community at large. The community at large will no longer create new projects, fix bugs in existing projects, write documentation, etc. around Drupal 7. * There will be no more core commits to Drupal 7. * The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 core or contributed modules, themes, or other projects. Reports about Drupal 7 vulnerabilities might become public creating 0 day exploits. * All Drupal 7 releases on all project pages will be flagged as not supported. Maintainers can change that flag if they desire to. * On Drupal 7 sites with the update status module, Drupal Core will show up as unsupported. * After November 2021, using Drupal 7 may be flagged as insecure in 3rd party scans as it no longer gets support. * Best practice is to not use unsupported software, it would not be advisable to continue to build new Drupal 7 sites. * Now is the time to start planning your migration to Drupal 8. If, for any reason, you are unable to migrate to Drupal 8 or 9 by the time version 7 reaches end of life, there will be a select number of organizations that will provide Drupal 7 Vendor Extended Support (D7ES) for their paying clients. This program is the successor to the successful Drupal 6 LTS program. Like that program, it will be an additional paid service, fully operated by these organizations with some help from the Security Team. The Drupal Association and Drupal Security Team will publish an announcement once we have selected the Drupal 7 Vendor Extended Support partners. If you would like more information about the Drupal release cycle, consult the official documentation on Drupal.org. If you would like more information about the upcoming release of Drupal 9, join us at DrupalCon Seattle. .... Information for organizations interested in providing commercial Drupal 7 Vendor Extended Support Organizations interested in providing commercial Drupal 7 Vendor Extended Support to their customers *and* who have the technical knowledge to maintain Drupal 7 are invited to fill out the application for the Drupal 7 Vendor Extended Support team [3]. The application submission should explain why the vendor is a good fit for the program, and explain how they meet the requirements as outlined below. Base requirements for this program include: * You must have experience in the public issue queue supporting Drupal 7 core or Drupal 7 Modules. You should be able to point to a history of such contribution. One way to measure this is issue credits, but there are other ways. You must continue this throughout your enrollment in the program. If you have other ways to show your experience, feel free to highlight them. * You must make a commitment to the Security Team, the Drupal Association, and your customers that you will remain active in this program for 3 years. * As a partner, you must contribute to at least 20% of all Drupal 7 Vendor Extended Support module patches and 80% of D7ES core patches in a given year. (Modules that have been moved into core in Drupal 8 count as part of core metrics in Drupal 7) . * Any organization involved in this program must have at least 1 member on the Drupal Security Team for at least 3 months prior to joining the program and while a member of the program. (See How to join the Drupal Security Team [4] for information.) This person will need a positive evaluation of their contributions from the Security Working Group. * Payment of an Drupal 7 Vendor Extended Support annual fee for program participation is required (around $3000 a year). These fees will go to communication tools for the Drupal 7 Vendor Extended Support vendors and/or the greater community. * Payment of a $450 application fee is required. * Your company must provide paid support to Drupal 7 clients. This program is not for companies that don't provide services to external clients. Application review process: 1) We will confirm that each vendor meets the requirements outlined above and is a good fit for the program. 2) If the Security Working Group does not think you are a good fit, we will explain why and decline your application. If you are rejected, you are able to reapply. Most rejections will be due to Organizations not having enough ongoing contribution to Drupal 7 and Organizations not having a Drupal Security Team member at their organization. 3) The Drupal Association signs off on your participation in the program. 4) If you are accepted, you will be added to the Drupal 7 Vendor Extended Support vendor mailing list. 5) The Security Working Group will do a coordinated announcement with the vendors to promote the program. If you have any questions you can email d7es at drupal.org [1] https://www.drupal.org/blog/drupal-7-8-and-9 [2] https://www.drupal.org/blog/plan-for-drupal-9 [3] https://www.surveymonkey.com/r/D7ES [4] https://www.drupal.org/drupal-security-team/how-to-join-the-drupal-security…

1 0

SA-CORE-2019-003 Notice of increased risk and Additional exploit path - PSA-2019-02-22
by security-news＠drupal.org 23 Feb '19

23 Feb '19

View online: https://www.drupal.org/psa-2019-02-22 Date: 2019-February-23 Vulnerability: SA-CORE-2019-003 Notice of increased risk and Additional exploit path Description: This Public Service Announcement is a follow-up to SA-CORE-2019-003. This is *not* an announcement of a new vulnerability. If you have not updated your site as described in SA-CORE-2019-003 [1] you should do that now. There are public exploits now available for this SA. As far as we know, this is not being mass exploited at this time. In the original SA we indicated this could be mitigated by blocking POST, PATCH and PUT requests to web services resources, there is now a new way to exploit this using GET requests. The best mitigation is: * If you are using Drupal 8.6.x, upgrade to Drupal 8.6.10 [2]. * If you are using Drupal 8.5.x or earlier, upgrade to Drupal 8.5.11 [3]. * Be sure to install any available security updates for contributed projects [4] after updating Drupal core. This only applies to your site if: * The site has the Drupal 8 core RESTful Web Services (rest) module enabled. OR * The site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7, or custom code that allows entity updates via non-form sources. -------- WHAT TO DO IF YOUR SITE MAY BE COMPROMISED -------------------------- Take a look at our existing documentation, ”Your Drupal site got hacked, now what”. [5] We’ll continue to update the SA [6] if novel types of exploit appear. [1] https://www.drupal.org/SA-CORE-2019-003 [2] https://www.drupal.org/project/drupal/releases/8.6.10 [3] https://www.drupal.org/project/drupal/releases/8.5.11 [4] https://www.drupal.org/security/contrib [5] https://www.drupal.org/node/2365547 [6] https://www.drupal.org/SA-CORE-2019-003

1 0

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2019-003
by security-news＠drupal.org 20 Feb '19

20 Feb '19

View online: https://www.drupal.org/sa-core-2019-003 Project: Drupal core [1] Date: 2019-February-20 Security risk: *Highly critical* 20∕25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote Code Execution CVE IDs: CVE-2019-6340 Description: Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: * The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or * the site has another web services module enabled (like JSON:API [3] in Drupal 8, or Services [4] or RESTful Web Services [5] in Drupal 7). Solution: * If you are using Drupal 8.6.x, upgrade to Drupal 8.6.10 [6]. * If you are using Drupal 8.5.x or earlier, upgrade to Drupal 8.5.11 [7]. * Be sure to install any available security updates for contributed projects [8] after updating Drupal core. * No core update is required for Drupal 7, but several Drupal 7 contributed modules [9] do require updates. Versions of Drupal 8 prior to 8.5.x are end-of-life and do not receive security coverage. To immediately mitigate the vulnerability, you can disable all web services modules, or configure your web server(s) to not allow PUT/PATCH/POST requests to web services resources. Note that web services resources may be available on multiple paths depending on the configuration of your server(s). For Drupal 7, resources are for example typically available via paths (clean URLs) and via arguments to the "q" query argument. For Drupal 8, paths may still function when prefixed with index.php/. Reported By: * Samuel Mortenson [10] of the Drupal Security Team Fixed By: * Sascha Grossenbacher [11] * Peter Wolanin [12] of the Drupal Security Team * Samuel Mortenson [13] of the Drupal Security Team * Daniel Wehner [14] * Cash Williams [15] of the Drupal Security Team * Wim Leers [16] * Jess [17] of the Drupal Security Team * Lee Rowlands [18] of the Drupal Security Team * Alex Pott [19] of the Drupal Security Team * Francesco Placella [20] * Damian Lee [21] * Tobias Zimmermann [22] * Ted Bowman [23] * Damien McKenna [24] of the Drupal Security Team * Alex Bronstein [25] of the Drupal Security Team * Rob Loach [26] * Gabe Sullice [27] * Michael Hess [28] of the Drupal Security Team * Neil Drumm [29] of the Drupal Security Team * Heshan Wanigasooriya [30] * David Snopek [31] of the Drupal Security Team * Wolfgang Ziegler [32] * Miro Dietiker [33] * Truls S. Yggeseth [34] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/jsonapi [4] https://www.drupal.org/project/services [5] https://www.drupal.org/project/restws [6] https://www.drupal.org/project/drupal/releases/8.6.10 [7] https://www.drupal.org/project/drupal/releases/8.5.11 [8] https://www.drupal.org/security/contrib [9] https://www.drupal.org/security/contrib [10] https://www.drupal.org/user/2582268 [11] https://www.drupal.org/user/214652 [12] https://www.drupal.org/user/49851 [13] https://www.drupal.org/user/2582268 [14] https://www.drupal.org/user/99340 [15] https://www.drupal.org/user/421070 [16] https://www.drupal.org/user/99777 [17] https://www.drupal.org/user/65776 [18] https://www.drupal.org/user/395439 [19] https://www.drupal.org/user/157725 [20] https://www.drupal.org/user/183211 [21] https://www.drupal.org/user/1037976 [22] https://www.drupal.org/user/107158 [23] https://www.drupal.org/user/240860 [24] https://www.drupal.org/user/108450 [25] https://www.drupal.org/user/78040 [26] https://www.drupal.org/user/61114 [27] https://www.drupal.org/user/2287430 [28] https://www.drupal.org/user/102818 [29] https://www.drupal.org/user/3064 [30] https://www.drupal.org/user/199102 [31] https://www.drupal.org/user/266527 [32] https://www.drupal.org/user/16747 [33] https://www.drupal.org/user/227761 [34] https://www.drupal.org/user/325866

1 0

Font Awesome Icons - Critical - Remote Code Execution - SA-CONTRIB-2019-025
by security-news＠drupal.org 20 Feb '19

20 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-025 Project: Font Awesome Icons [1] Date: 2019-February-20 Security risk: *Critical* 18∕25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote Code Execution Description: This resolves issues described in SA-CORE-2019-003 [3] for this module. Not all configurations are affected. See SA-CORE-2019-003 [4] for details. Solution: * If you use the Font Awesome Icons module for Drupal 8.x, upgrade to Font Awesome Icons 8.x-2.12 [5]. [1] https://www.drupal.org/project/fontawesome [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/sa-core-2019-003 [5] https://www.drupal.org/project/fontawesome/releases/8.x-2.12

1 0

Translation Management Tool - Critical - Remote Code Execution - SA-CONTRIB-2019-024
by security-news＠drupal.org 20 Feb '19

20 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-024 Project: Translation Management Tool [1] Date: 2019-February-20 Security risk: *Critical* 16∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote Code Execution Description: This resolves issues described in SA-CORE-2019-003 [3] for this module. Not all configurations are affected. See SA-CORE-2019-003 [4] for details. Solution: * If you use the TMGMT module for Drupal 8.x, upgrade to TMGMT 8.x-1.7 [5]. [1] https://www.drupal.org/project/tmgmt [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/sa-core-2019-003 [5] https://www.drupal.org/project/TMGMT/releases/8.x-1.7

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news February 2019