August 2021 - Security-news - lists.drupal.org

Webform - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-026
by security-news＠drupal.org 25 Aug '21

25 Aug '21

View online: https://www.drupal.org/sa-contrib-2021-026 Project: Webform [1] Date: 2021-August-25 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: The Webform module uses the CKEditor [3], library for WYSIWYG editing. CKEditor has released a security update that impacts Webform [4]. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access. For more information, see CKEditor's announcement of the release [5]. Solution: Install the latest version: * If you use the Webform module module for Drupal 8/9 upgrade to Webform 8.x-5.28 [6] or Webform 6.0.5 [7] If you are using a previous release of the Webform module you can immediately do one of several options. 1) Update Drupal 2) If you are using Composer, run drush webform:libraries:composer > DRUPAL_ROOT/composer.libraries.json and run composer update 3) If you are using Drush, run drush webform:libraries:update Learn more about updating Webform libraries. [8] Reported By: * Lee Rowlands [9] of the Drupal Security Team Fixed By: * Jacob Rockowitz [10] Coordinated By: * Greg Knaddison [11] of the Drupal Security Team * xjm [12] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/ckeditor/ckeditor4 [4] https://ckeditor.com/blog/ckeditor-4.16.2-with-browser-improvements-and-sec… [5] https://ckeditor.com/blog/ckeditor-4.16.2-with-browser-improvements-and-sec… [6] https://www.drupal.org/project/webform/releases/8.x-5.28 [7] https://www.drupal.org/project/webform/releases/6.0.5 [8] https://www.drupal.org/docs/contributed-modules/webform/webform-libraries [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/371407 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/user/65776

1 0

Admin Toolbar - Moderately critical - Cross Site Scripting, Access Bypass - SA-CONTRIB-2021-025
by security-news＠drupal.org 25 Aug '21

25 Aug '21

View online: https://www.drupal.org/sa-contrib-2021-025 Project: Admin Toolbar [1] Date: 2021-August-25 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting, Access Bypass Description: The /Admin Toolbar/ (admin_toolbar) module extends the default toolbar provided by Drupal Core with various features facilitating day-to-day editorial and administrative work. The /Admin Toolbar Search/ sub-module of this module * doesn't sanitize user input in certain cases, which leads to a Cross-Site-Scripting (XSS) vulnerability. An attacker that can create or edit certain entities, entity bundles or entity types may be able to exploit one or more Cross-Site-Scripting (XSS) vulnerabilities to target users with access to the /Admin Toolbar Search/ search box, including site admins with privileged access. * doesn't properly check access in certain cases, which may result in an information disclosure vulnerability of entity type and bundle labels. The vulnerability is mitigated by the facts, that: * the /Admin Toolbar Search/ sub-module must be enabled. * an attacker must have one of several permissions, of which at least some are commonly only assigned to either editors, site builders or administrators. * a targeted account must have permission to use the search box provided by the /Admin Toolbar Search/ sub-module. Solution: Install the latest version: * If you use admin_toolbar 3.0.0 or later, upgrade to Admin Toolbar 3.0.2 [3]. * If you use admin_toolbar 8.x-2.0 or later, upgrade to Admin Toolbar 8.x-2.5 [4]. Also see the Admin Toolbar project page [5]. Reported By: * Patrick Fey [6] Fixed By: * Romain Jarraud [7] * Patrick Fey [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/admin_toolbar [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/admin_toolbar/releases/3.0.2 [4] https://www.drupal.org/project/admin_toolbar/releases/8.x-2.5 [5] https://www.drupal.org/project/admin_toolbar/ [6] https://www.drupal.org/user/998680 [7] https://www.drupal.org/user/370706 [8] https://www.drupal.org/user/998680 [9] https://www.drupal.org/user/36762

1 0

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2021-005
by security-news＠drupal.org 12 Aug '21

12 Aug '21

View online: https://www.drupal.org/sa-core-2021-005 Project: Drupal core [1] Date: 2021-August-12 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Third-party libraries Description: The Drupal project uses the CKEditor [3], library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal [4]. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access. For more information, see CKEditor's announcement of the release [5]. This advisory is not covered by Drupal Steward [6]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.4 [7]. * If you are using Drupal 9.1, update to Drupal 9.1.12 [8]. * If you are using Drupal 8.9, update to Drupal 8.9.18 [9]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core is not affected, although Drupal 7, 8, and 9 site owners should review their site following the protocol for managing external libraries and plugins [10] previously suggested by the Drupal Security Team, as contributed projects may use additional CKEditor plugins not packaged in Drupal core. Reported By: * Krzysztof Krzton [11] Fixed By: * xjm [12] of the Drupal Security Team * Jen Lampton [13] * Wim Leers [14] * Chris McCafferty [15] of the Drupal Security Team * James Gilliland [16] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/ckeditor/ckeditor4 [4] https://ckeditor.com/blog/ckeditor-4.16.2-with-browser-improvements-and-sec… [5] https://ckeditor.com/blog/ckeditor-4.16.2-with-browser-improvements-and-sec… [6] https://www.drupal.org/steward [7] https://www.drupal.org/project/drupal/releases/9.2.4 [8] https://www.drupal.org/project/drupal/releases/9.1.12 [9] https://www.drupal.org/project/drupal/releases/8.9.18 [10] https://www.drupal.org/psa-2011-002 [11] https://www.drupal.org/user/3618903 [12] https://www.drupal.org/user/65776 [13] https://www.drupal.org/user/85586 [14] https://www.drupal.org/user/99777 [15] https://www.drupal.org/user/1850070 [16] https://www.drupal.org/user/48673

1 0

Drupal 8 and 9 core release on August 12, 2021 - PSA-2021-08-09
by security-news＠drupal.org 09 Aug '21

09 Aug '21

View online: https://www.drupal.org/psa-2021-08-09 Date: 2021-August-09 Description: The Drupal Security Team will be coordinating a security release for Drupal core 8.9, 9.1, and 9.2 this week on *Thursday, August 12, 2021*. We are issuing this PSA in advance because August 12, 2021 is not a security window in the regular Drupal security release window schedule [1], so there would not normally be any security release on this date. The Drupal core release will be made between 16:00 – 21:00 UTC (noon – 5:00pm EDT). It is rated as moderately critical and will be an update to a vendor library only. Drupal 7 core is not affected, although Drupal 7 site owners should review their site following the protocol for managing external libraries and plugins [2] previously suggested by the Drupal Security Team. [1] https://www.drupal.org/node/1173280 [2] https://www.drupal.org/psa-2011-002

1 0