January 2022 - Security-news - lists.drupal.org

Swiftype integration - Critical - Unsupported - SA-CONTRIB-2022-012
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-012 Project: Swiftype integration [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/swiftype [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Navbar - Moderately critical - Cross Site Scripting - SA-CONTRIB-2022-011
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-011 Project: Navbar [1] Date: 2022-January-25 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description: This module provides a very simple, mobile-friendly navigation toolbar. The module doesn't sufficiently check for user-provided input. This vulnerability is mitigated by the fact that an attacker must have the ability to post content using a text format (like the default "Filtered HTML" format) that won't filter out the exploit code. Solution: Install the latest version: * If you use the Navbar module for Drupal 7.x, upgrade to Navbar 7.x-1.8 [3] Reported By: * Yonatan Offek [4] Fixed By: * Ivo Van Geertruyen [5] of the Drupal Security Team Coordinated By: * David Snopek [6] of the Drupal Security Team [1] https://www.drupal.org/project/navbar [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/navbar/releases/7.x-1.8 [4] https://www.drupal.org/user/194009 [5] https://www.drupal.org/user/383424 [6] https://www.drupal.org/user/266527

1 0

Rate - Critical - Unsupported - SA-CONTRIB-2022-010
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-010 Project: Rate [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/rate [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Expire reset password link - Critical - Unsupported - SA-CONTRIB-2022-009
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-009 Project: Expire reset password link [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/expire_reset_pass_link [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Admin Toolbar Search - Critical - Unsupported - SA-CONTRIB-2022-008
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-008 Project: Admin Toolbar Search [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/admin_toolbar_search [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Colorbox - Critical - Unsupported - SA-CONTRIB-2022-007
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-007 Project: Colorbox [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/colorbox [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Taxonomy Access Control Lite - Critical - Unsupported - SA-CONTRIB-2022-006
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-006 Project: Taxonomy Access Control Lite [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/tac_lite [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Prevent anonymous users to access Drupal pages - Critical - Unsupported - SA-CONTRIB-2022-005
by security-news＠drupal.org 26 Jan '22

26 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-005 Project: Prevent anonymous users to access Drupal pages [1] Date: 2022-January-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/anonymousredirect [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

jQuery UI Datepicker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2022-004
by security-news＠drupal.org 19 Jan '22

19 Jan '22

View online: https://www.drupal.org/sa-contrib-2022-004 Project: jQuery UI Datepicker [1] Date: 2022-January-19 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Cross Site Scripting Description: jQuery UI is a third-party library used by Drupal. The jQuery UI Datepicker module provides the jQuery UI Datepicker library, which is not included in Drupal 9 core. jQuery UI was previously thought to be end-of-life. Late in 2021, jQuery UI announced that they would be continuing development, and released a jQuery UI 1.13.0 [3] version. As part of this 1.13.0 update, they disclosed the following security issues that may affect site using the jQuery UI Datepicker module: * CVE-2021-41182: XSS in the altField option of the Datepicker widget [4] * CVE-2021-41183: XSS in *Text options of the Datepicker widget [5] Solution: Install the latest version: * If you use the jQuery UI Datepicker module for Drupal 9.x, upgrade to jQuery UI Datepicker 8.x-1.2 [6] Reported By: * Lauri Eskola [7] Fixed By: * Andrei Ivnitskii [8] * Ben Mullins [9] * Lauri Eskola [10] [1] https://www.drupal.org/project/jquery_ui_datepicker [2] https://www.drupal.org/security-team/risk-levels [3] https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/ [4] https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc [5] https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4 [6] https://www.drupal.org/project/jquery_ui_datepicker/releases/8.x-1.2 [7] https://www.drupal.org/user/1078742 [8] https://www.drupal.org/user/3547706 [9] https://www.drupal.org/user/2369194 [10] https://www.drupal.org/user/1078742

1 0

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2022-001
by security-news＠drupal.org 19 Jan '22

19 Jan '22

View online: https://www.drupal.org/sa-core-2022-001 Project: Drupal core [1] Date: 2022-January-19 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Cross Site Scripting Description: jQuery UI is a third-party library used by Drupal. This library was previously thought to be end-of-life. Late in 2021, jQuery UI announced that they would be continuing development, and released a jQuery UI 1.13.0 [3] version. As part of this 1.13.0 update, they disclosed the following security issue that may affect Drupal 9 and 7: * CVE-2021-41183: XSS in the of option of the .position() util [4] It is possible that this vulnerability is exploitable with some Drupal modules. As a precaution, this Drupal security release applies the fix for the above cross-site description issue, without making any of the other changes to the jQuery version that is included in Drupal. This advisory is not covered by Drupal Steward [5]. Solution: Install the latest version: * If you are using Drupal 9.3, update to Drupal 9.3.3 [6]. * If you are using Drupal 9.2, update to Drupal 9.2.11 [7]. * If you are using Drupal 7, update to Drupal 7.86 [8]. All versions of Drupal 8 and 9 prior to 9.2.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life [9]. Reported By: * Lauri Eskola [10] Fixed By: * Lauri Eskola [11] * Chris [12] of the Drupal Security Team * Drew Webber [13] of the Drupal Security Team * Alex Bronstein [14] of the Drupal Security Team * Ben Mullins [15] * xjm [16] of the Drupal Security Team * Théodore Biadala [17] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/ [4] https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4 [5] https://www.drupal.org/steward [6] https://www.drupal.org/project/drupal/releases/9.3.3 [7] https://www.drupal.org/project/drupal/releases/9.2.11 [8] https://www.drupal.org/project/drupal/releases/7.86 [9] https://www.drupal.org/psa-2021-06-29 [10] https://www.drupal.org/user/1078742 [11] https://www.drupal.org/user/1078742 [12] https://www.drupal.org/user/1850070 [13] https://www.drupal.org/user/255969 [14] https://www.drupal.org/user/78040 [15] https://www.drupal.org/user/2369194 [16] https://www.drupal.org/user/65776 [17] https://www.drupal.org/user/598310

1 0