November 2021 - Security-news

Drupal 8 is now end-of-life - PSA-2021-11-30
by security-news＠drupal.org 30 Nov '21

30 Nov '21

View online: https://www.drupal.org/psa-2021-11-30 Date: 2021-November-30 Description: As of November 17, 2021, the Drupal core version 8 series has reached end-of-life. This means that all releases of Drupal 8 core (with 8.y.x version numbers) and Drupal contributed project releases that are compatible with only Drupal 8 will be marked unsupported as they no longer have security team support. Drupal 8.0.0 was first released on November 9, 2015. The last version was released on November 17, 2021. All Drupal 8 site owners must upgrade to Drupal 9 [1] to receive security updates and bug fixes. The Drupal Association will also disable testing with unsupported versions of Drupal. Security issues that only affect Drupal 8 (and not Drupal 9 or Drupal 7) will be made public and sites are at risk of having these issues exploited if they do not upgrade. .... What about Drupal 7 and Drupal 9? Contributed projects like themes and modules will still receive security advisories if they are compatible with either Drupal 7 or 9 and have opted in to security coverage. Drupal 7's end-of-life is currently scheduled for November of 2022 [2], and it will receive security updates until then. Drupal 9's end-of-life is scheduled for November of 2023. For more information on release schedules, see the core release cycle overview [3]. [1] https://www.drupal.org/docs/upgrading-drupal/how-to-prepare-your-drupal-7-o… [2] https://www.drupal.org/psa-2020-06-24 [3] https://www.drupal.org/core/release-cycle-overview

1 0

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2021-011
by security-news＠drupal.org 17 Nov '21

17 Nov '21

View online: https://www.drupal.org/sa-core-2021-011 Project: Drupal core [1] Date: 2021-November-17 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description: The Drupal project uses the CKEditor [3] library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal [4]. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access. For more information, see CKEditor's security advisories: * CVE-2021-41165: HTML comments vulnerability allowing to execute JavaScript code [5] * CVE-2021-41164: Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML [6] This advisory is not covered by Drupal Steward [7]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.9 [8]. * If you are using Drupal 9.1, update to Drupal 9.1.14 [9]. * If you are using Drupal 8.9, update to Drupal 8.9.20 [10]. Versions of Drupal prior to 9.1.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life [11] so this is the final security release provided for Drupal 8. Drupal 7 core does not include the CKEditor module and therefore is not affected. Reported By: * Jacek Bogdański [12] coordinated on the release with Drupal project. * See the CKEditor announcements above for the original reporters of the vulnerabilities. Fixed By: * xjm [13] of the Drupal Security Team * Wim Leers [14] * Greg Knaddison [15] of the Drupal Security Team * Lauri Eskola [16] * Ted Bowman [17] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/ckeditor/ckeditor4 [4] https://ckeditor.com/cke4/release/CKEditor-4.17.0 [5] https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qh… [6] https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cp… [7] https://www.drupal.org/steward [8] https://www.drupal.org/project/drupal/releases/9.2.9 [9] https://www.drupal.org/project/drupal/releases/9.1.14 [10] https://www.drupal.org/project/drupal/releases/8.9.20 [11] https://www.drupal.org/psa-2021-06-29 [12] https://www.drupal.org/user/3683355 [13] https://www.drupal.org/user/65776 [14] https://www.drupal.org/user/99777 [15] https://www.drupal.org/user/36762 [16] https://www.drupal.org/user/1078742 [17] https://www.drupal.org/user/240860

1 0

OpenID Connect Microsoft Azure Active Directory client - Moderately critical - Access Bypass - SA-CONTRIB-2021-044
by security-news＠drupal.org 17 Nov '21

17 Nov '21

View online: https://www.drupal.org/sa-contrib-2021-044 Project: OpenID Connect Microsoft Azure Active Directory client [1] Date: 2021-November-17 Security risk: *Moderately critical* 14∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access Bypass Description: This module enables users to authenticate through their Microsoft Azure AD account. The module does not sufficiently check authorization before updating user profile information in certain non-default configurations. This could lead a user being able to hijack another existing account. This vulnerability is mitigated by the fact that an attacker must have knowledge of user accounts that have the administrator role or accounts with the 'Set a password for local authentication' permission. In addition the site must be configured with the 'Update email address in user profile' setting turned on. Solution: Install the latest version: * If you use the OpenID Connect Microsoft Azure Active Directory client module 7.x-1.x, upgrade to OpenID Connect Microsoft Azure Active Directory client 7.x-1.2 [3] * If you use the OpenID Connect Microsoft Azure Active Directory client module 8.x-1.x, upgrade to OpenID Connect Microsoft Azure Active Directory client 8.x-1.4 [4] Reported By: * John Kingsnorth [5] Fixed By: * John Kingsnorth [6] * Lee Rowlands [7] of the Drupal Security Team * Jesse Payne [8] * Fabian de Rijk [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/openid_connect_windows_aad [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/openid_connect_windows_aad/releases/7.x-1.2 [4] https://www.drupal.org/project/openid_connect_windows_aad/releases/8.x-1.4 [5] https://www.drupal.org/user/2659819 [6] https://www.drupal.org/user/2659819 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/696648 [9] https://www.drupal.org/user/278745 [10] https://www.drupal.org/user/36762

1 0