January 2022 - Security-news - lists.drupal.org

Printer, email and PDF versions - Critical - Unsupported - SA-CONTRIB-2022-022
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-022 Project: Printer, email and PDF versions [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/print [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Image Media Export Import - Critical - Unsupported - SA-CONTRIB-2022-021
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-021 Project: Image Media Export Import [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/image_export_import [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Remote Stream Wrapper - Critical - Unsupported - SA-CONTRIB-2022-020
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-020 Project: Remote Stream Wrapper [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/remote_stream_wrapper [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Vendor Stream Wrapper - Critical - Unsupported - SA-CONTRIB-2022-019
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-019 Project: Vendor Stream Wrapper [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/vendor_stream_wrapper [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Cog - Critical - Unsupported - SA-CONTRIB-2022-018
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-018 Project: Cog [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/cog [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Media Entity Flickr - Critical - Unsupported - SA-CONTRIB-2022-017
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-017 Project: Media Entity Flickr [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/media_entity_flickr [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Vocabulary Permissions Per Role - Critical - Unsupported - SA-CONTRIB-2022-016
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-016 Project: Vocabulary Permissions Per Role [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/vppr [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Exif - Critical - Unsupported - SA-CONTRIB-2022-015
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-015 Project: Exif [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/exif [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Private Taxonomy Terms - Critical - Access bypass, Information Disclosure, Multiple vulnerabilities - SA-CONTRIB-2022-014
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-014 Project: Private Taxonomy Terms [1] Date: 2022-January-26 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass, Information Disclosure, Multiple vulnerabilities Description: This module enables users to create 'private' vocabularies. The module doesn't sufficiently check user access permissions when attempting to view, edit, or add terms to vocabularies, including vocabularies not managed by the module. Partial mitigation is available by requiring users have been granted at least "Administer own taxonomy", "Edit own terms in vocabulary_name" or "Delete own terms in vocabulary_name" permissions, however this does not mitigate all known issues. Solution: Install the latest version: * If you use the Private Taxonomy Terms module for Drupal 8 or 9, upgrade to Private Taxonomy Terms 8.x-2.5 [3] * If you use the Private Taxonomy Terms module for Drupal 7.x, upgrade to Private Taxonomy Terms 7.x-1.11 [4] Reported By: * Conrad Lara [5] Fixed By: * Conrad Lara [6] * Greg Knaddison [7] of the Drupal Security Team * Chris [8] of the Drupal Security Team Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * Chris [10] of the Drupal Security Team [1] https://www.drupal.org/project/private_taxonomy [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/private_taxonomy/releases/8.x-2.5 [4] https://www.drupal.org/project/private_taxonomy/releases/7.x-1.11 [5] https://www.drupal.org/user/1790054 [6] https://www.drupal.org/user/1790054 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/1850070 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/1850070

1 0

Business Responsive Theme - Critical - Unsupported - SA-CONTRIB-2022-013
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-013 Project: Business Responsive Theme [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/business_responsive_theme [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0