January 2024 - Security-news - lists.drupal.org

Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007
by security-news＠drupal.org 31 Jan '24

31 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-007 Project: Entity Delete Log [1] Date: 2024-January-31 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.1.1 Description: The Entity Delete Log module tracks the deletion of configured entity types, such as node or comments. It does not add sufficient permission to the log report page, allowing an attacker to view information from deleted entities. Solution: Install the latest version: * If you use the Entity Delete Log module for Drupal 9.x/10.x, upgrade to Entity Delete Log 1.1.1 [3] Note: This release updates the default permissions for the entity_delete_log view. After the update, you may want to review that permission if you already changed it from the default. Reported By: * Ryan Szrama [4] Fixed By: * Malay Nayak [5] * Virendra Singh [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Heine [8] of the Drupal Security Team * Benji Fisher [9] of the Drupal Security Team [1] https://www.drupal.org/project/entity_delete_log [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity_delete_log/releases/1.1.1 [4] https://www.drupal.org/user/49344 [5] https://www.drupal.org/user/3529755 [6] https://www.drupal.org/user/3652392 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/17943 [9] https://www.drupal.org/user/683300

1 0

Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006
by security-news＠drupal.org 24 Jan '24

24 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-006 Project: Swift Mailer [1] Date: 2024-January-24 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: The Drupal Swift Mailer module extends the basic e-mail sending functionality provided by Drupal by delegating all e-mail handling to the Swift Mailer library. This enables your site to take advantage of the many features which the Swift Mailer library provides. The module could allow an attacker to gain widespread access to a Drupal site. This vulnerability is mitigated by the fact that an attacker must have a means to trigger sending an email with a body that they can control, which would requires either another contributed module or custom integration. Solution: Uninstall this module immediately. The swiftmailer library has been unsupported for a year, and this module is now also unsupported. Changing to a replacement module is suggested, the following were specifically suggested by the module maintainers: * Drupal Symfony Mailer Lite [3] * Drupal Symfony Mailer [4] Reported By: * Adam Shepherd [5] Fixed By: * Adam Shepherd [6] * Wayne Eaker [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/swiftmailer [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/symfony_mailer_lite [4] https://www.drupal.org/project/symfony_mailer [5] https://www.drupal.org/user/2650563 [6] https://www.drupal.org/user/2650563 [7] https://www.drupal.org/user/326925 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762

1 0

Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005
by security-news＠drupal.org 24 Jan '24

24 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-005 Project: Open Social [1] Date: 2024-January-24 Security risk: *Moderately critical* 13∕25 AC:None/A:User/CI:Some/II:None/E:Proof/TD:Default [2] Vulnerability: Information Disclosure Affected versions: <12.0.5 Description: Open Social is a Drupal distribution for online communities. The included optional social_group_flexible_group module doesn't sufficiently validate group updates. The lack of validation makes it possible to have content inside the group changing it's visibility, which could lead to that content being shown to a broader audience than intended. This vulnerability is mitigated by the fact the module social_group_flexible_group needs to be enabled. Solution: Install the latest version of Open Social: * If you use the Open Social distribution for Drupal 12.x, upgrade to Open Social 12.0.5 [3] Reported By: * Taras Kruts [4] Fixed By: * Taras Kruts [5] * Ronald te Brake [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/12.0.5 [4] https://www.drupal.org/user/1449610 [5] https://www.drupal.org/user/1449610 [6] https://www.drupal.org/user/2314038 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004
by security-news＠drupal.org 24 Jan '24

24 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-004 Project: Open Social [1] Date: 2024-January-24 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <12.05 Description: Content within Open Social can have different visibilities. It is possible for a user to create public content even when this should not be allowed. This vulnerability is mitigated by the fact that the site must have public visibility disabled on a global level. Solution: Install the latest version of Open Social: * If you use the Open Social distribution for Drupal 12.x, upgrade to Open Social 12.0.5 [3] Reported By: * Corn696 [4] Fixed By: * Corn696 [5] * Tiago Siqueira [6] * Robert Ragas [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/12.0.5 [4] https://www.drupal.org/user/3544002 [5] https://www.drupal.org/user/3544002 [6] https://www.drupal.org/user/2822445 [7] https://www.drupal.org/user/2723261 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762

1 0

Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003
by security-news＠drupal.org 24 Jan '24

24 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-003 Project: Two-factor Authentication (TFA) [1] Date: 2024-January-24 Security risk: *Moderately critical* 14∕25 AC:Complex/A:None/CI:Some/II:Some/E:Proof/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.5.0 Description: This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. In some cases, the module allows users to log in with an authentication plugin that an administrator has disabled. This vulnerability is mitigated by the fact that an attacker must obtain a valid first-factor login credential, that an administrator must enable and then disable an authentication plugin, and that an attacker must obtain the valid second factor credential for the disabled plugin. Solution: Install the latest 8.x-1.2 version: * If you use the Two-factor Authentication (TFA) for Drupal 8, 9, or 10 upgrade to TFA 8.x-1.5 [3] After installing this update disabled plugins will no longer be offered or accepted as a second factor option. If an account is configured with only disabled plugins login will be prohibited and the the configured TFA "Help text" displayed instead of a second factor prompt. To allow access for a locked out user site owners may consider enabling the plugin (admin/config/people/tfa) or may use their existing procedures for granting access to accounts where the user has forgotten/lost their second factor tokens. Accounts with both enabled and disabled plugins will prompt the account owner with one of the remaining enabled plugins. Reported By: * Ide Braakman [4] Fixed By: * Conrad Lara [5] * Juraj Nemec [6] of the Drupal Security Team * João Ventura [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team * Benji Fisher [10] of the Drupal Security Team [1] https://www.drupal.org/project/tfa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tfa/releases/8.x-1.5 [4] https://www.drupal.org/user/1879760 [5] https://www.drupal.org/user/1790054 [6] https://www.drupal.org/user/272316 [7] https://www.drupal.org/user/122464 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/683300

1 0

Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
by security-news＠drupal.org 17 Jan '24

17 Jan '24

View online: https://www.drupal.org/sa-core-2024-001 Project: Drupal core [1] Date: 2024-January-17 Security risk: *Moderately critical* 11∕25 AC:None/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] Vulnerability: Denial of Service Affected versions: >=8.0 <10.1.8 || >=10.2 <10.2.2 Description: The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS). Sites that do not use the Comment module are not affected. Solution: Install the latest version: * If you are using Drupal 10.2, update to Drupal 10.2.2 [3]. * If you are using Drupal 10.1, update to Drupal 10.1.8 [4]. All versions of Drupal 10 prior to 10.1 are end-of-life and do not receive security coverage. (Drupal 8 [5] and Drupal 9 [6] have both reached end-of-life.) Drupal 7 is not affected. Reported By: * Alexander Antonenko [7] * Doug Green [8] Fixed By: * Lee Rowlands [9] of the Drupal Security Team * Benji Fisher [10] of the Drupal Security Team * Juraj Nemec [11] of the Drupal Security Team * xjm [12] of the Drupal Security Team * Lauri Eskola [13], provisional member of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/10.2.2 [4] https://www.drupal.org/project/drupal/releases/10.1.8 [5] https://www.drupal.org/psa-2021-06-29 [6] https://www.drupal.org/psa-2023-11-01 [7] https://www.drupal.org/user/225734 [8] https://www.drupal.org/user/29191 [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/683300 [11] https://www.drupal.org/user/272316 [12] https://www.drupal.org/user/65776 [13] https://www.drupal.org/user/1078742

1 0

Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002
by security-news＠drupal.org 10 Jan '24

10 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-002 Project: Typogrify [1] Date: 2024-January-10 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: <1.3.0 Description: The Typogrify module brings the typographic refinements of Typogrify to Drupal. It provides a text filter and a Twig filter. The typogrify Twig filter can be used to bypass the Twig auto-escape feature, leading to a persistent Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that it is only exposed when the twig filter is specifically used in a template to render content. Solution: Install the latest version: * If you use the Typogrify module for Drupal 10.x, upgrade to Typogrify 8.x-1.3 [3] If you use the typogrify Twig filter provided by this module, then this update may cause double-encoding of text. See the updated README for best practices. Reported By: * Pierre Rudloff [4] Fixed By: * Benji Fisher [5] of the Drupal Security Team Coordinated By: * Damien McKenna [6] of the Drupal Security Team * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/typogrify [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/typogrify/releases/8.x-1.3 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/683300 [6] https://www.drupal.org/user/108450 [7] https://www.drupal.org/user/36762

1 0

File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001
by security-news＠drupal.org 10 Jan '24

10 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-001 Project: File Entity (fieldable files) [1] Date: 2024-January-10 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting, Access bypass Description: File entity provides interfaces for managing files. It also extends the core file entity, allowing files to be fieldable, grouped into types, viewed (using display modes) and formatted using field formatters. The module previously did not sufficiently validate files under the scenario of a file replacement leading to multiple exploit paths including persistent Cross Site Scripting. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to edit files. Solution: Install the latest version: * If you use the file_entity module for Drupal 7.x, upgrade to File Entity 7.x-2.38 [3]. Reported By: * Caroline Boyden [4] Fixed By: * Joseph Olstad [5] * Sascha Grossenbacher [6] * Caroline Boyden [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/file_entity [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/file_entity/releases/7.x-2.38 [4] https://www.drupal.org/user/657902 [5] https://www.drupal.org/user/1321830 [6] https://www.drupal.org/user/214652 [7] https://www.drupal.org/user/657902 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762

1 0