View online: https://www.drupal.org/psa-2021-05-25
Date: 2021-May-25
Description:
There will be a security release of Drupal Core 8.9.x, and 9.1.x on May 26th,
2021 between 16:00 - 18:00 UTC. This Public Service Advisory is to notify
that the Drupal core release is outside of the regular schedule of security
releases. For all security updates, the Drupal Security Team urges you to
reserve time for core updates at that time because there is some risk that
exploits might be developed within hours or days. Security release
announcements will appear on the Drupal.org security advisory page.
The security risk of the advisory is currently rated as Moderately Critical.
This is not a mass-exploitable vulnerability as far as the security team is
currently aware.
Given that this is a moderately critical vulnerability and is not believed to
be mass exploitable it is not covered by Drupal Steward partners. [1]
[1] https://www.drupal.org/drupal-security-team/steward
View online: https://www.drupal.org/sa-contrib-2021-009
Project: Chaos Tool Suite (ctools) [1]
Version: 8.x-3.58.x-3.48.x-3.38.x-3.28.x-3.18.x-3.0
Date: 2021-May-12
Security risk: *Moderately critical* 12∕25
AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All [2]
Vulnerability: Information disclosure
Description:
Chaos tool suite (ctools) module provides a number of APIs and extensions for
Drupal, it's 8.x-3.x branch is a start from scratch to evaluate the features
of ctools that didn't make it into Drupal Core 8.0.x and port them.
The module doesn't sufficiently handle access control on its EntityView
plugin.
This vulnerability is mitigated by the fact that successful exploitation
requires special conditions in place such as custom solutions that allow
injecting the context by means other than the route.
Solution:
Install the latest version:
* If you use the Chaos tool suite module for Drupal 8.x, upgrade to Chaos
tool suite 8.x-3.6 [3]
Reported By:
* Jonathan Hedstrom [4]
Fixed By:
* Jonathan Hedstrom [5]
* Balazs Janos Tatar [6]
* Jakob Perry [7]
Coordinated By:
* Greg Knaddison [8] of the Drupal Security Team
[1] https://www.drupal.org/project/ctools
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/ctools/releases/8.x-3.6
[4] https://www.drupal.org/user/208732
[5] https://www.drupal.org/user/208732
[6] https://www.drupal.org/user/649590
[7] https://www.drupal.org/user/45640
[8] https://www.drupal.org/u/greggles