Security-news April 2021

security-news@drupal.org

1 participants
2 discussions

SAML Authentication - Moderately critical - Access bypass - SA-CONTRIB-2021-006
by security-news＠drupal.org 28 Apr '21

28 Apr '21

View online: https://www.drupal.org/sa-contrib-2021-006 Project: SAML Authentication [1] Date: 2021-April-28 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The SAML Authentication module [3] allows users to authenticate against a SAML identity provider to login to your Drupal site. The module doesn't sufficiently protect against unauthorized local access, by way of using the 'password reset' facility, for users who are supposed to only be able to log in through the identity provider. This creates a scenario where after such a user is blocked from logging in through the identity provider but not explicitly blocked in Drupal, they are still able to log in by sending themselves a Drupal 'password reset' e-mail. Solution: Install the latest version: * for all versions of Drupal 8/9, upgrade to samlauth 8.x-3.1 [4]. * for Drupal 7, upgrade to samlauth 7.x-1.1 [5]. Reported By: * Bobby Gryzynger [6] * Mark Shropshire [7] Fixed By: * Bobby Gryzynger [8] * Roderik Muit [9] * Jakob Perry [10] * Sascha Grossenbacher [11] * Cameron Eagans [12] * Drew Webber [13] of the Drupal Security Team Coordinated By: * Greg Knaddison [14] of the Drupal Security Team [1] https://www.drupal.org/project/samlauth [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/samlauth [4] https://www.drupal.org/project/samlauth/releases/8.x-3.1 [5] https://www.drupal.org/project/samlauth/releases/7.x-1.1 [6] https://www.drupal.org/user/3311649 [7] https://www.drupal.org/user/14767 [8] https://www.drupal.org/user/3311649 [9] https://www.drupal.org/user/8841 [10] https://www.drupal.org/user/45640 [11] https://www.drupal.org/user/214652 [12] https://www.drupal.org/user/404732 [13] https://www.drupal.org/user/255969 [14] https://www.drupal.org/user/36762

1 0

Drupal core - Critical - Cross-site scripting - SA-CORE-2021-002
by security-news＠drupal.org 21 Apr '21

21 Apr '21

View online: https://www.drupal.org/sa-core-2021-002 Project: Drupal core [1] Date: 2021-April-21 Security risk: *Critical* 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Description: Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. Not all sites and users are affected, but configuration changes to prevent the exploit might be impractical and will vary between sites. Therefore, we recommend all sites update to this release as soon as possible. Solution: Install the latest version: * If you are using Drupal 9.1, update to Drupal 9.1.7 [3]. * If you are using Drupal 9.0, update to Drupal 9.0.12 [4]. * If you are using Drupal 8.9, update to Drupal 8.9.14 [5]. * If you are using Drupal 7, update to Drupal 7.80 [6]. Versions of Drupal 8 prior to 8.9.x are end-of-life and do not receive security coverage. Reported By: * Jasper Mattsson [7] Fixed By: * Alex Pott [8] of the Drupal Security Team * Jasper Mattsson [9] * Michael Hess [10] of the Drupal Security Team * Wim Leers [11] * Heine [12] of the Drupal Security Team * Peter Wolanin [13] of the Drupal Security Team * Jess (xjm) [14] of the Drupal Security Team * Samuel Mortenson [15] of the Drupal Security Team * nwellnhof [16] * Alex Bronstein [17] of the Drupal Security Team * Lee Rowlands [18] of the Drupal Security Team * Adam G-H [19] * Drew Webber [20] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/9.1.7 [4] https://www.drupal.org/project/drupal/releases/9.0.12 [5] https://www.drupal.org/project/drupal/releases/8.9.14 [6] https://www.drupal.org/project/drupal/releases/7.80 [7] https://www.drupal.org/user/521118 [8] https://www.drupal.org/user/157725 [9] https://www.drupal.org/user/521118 [10] https://www.drupal.org/user/102818 [11] https://www.drupal.org/user/99777 [12] https://www.drupal.org/user/17943 [13] https://www.drupal.org/user/49851 [14] https://www.drupal.org/user/65776 [15] https://www.drupal.org/user/2582268 [16] https://www.drupal.org/user/3407764 [17] https://www.drupal.org/user/78040 [18] https://www.drupal.org/user/395439 [19] https://www.drupal.org/user/205645 [20] https://www.drupal.org/user/255969

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news April 2021