Security-news June 2024

security-news@drupal.org

1 participants
2 discussions

3rd Party Libraries and Supply Chains - PSA-2024-06-26
by security-news＠drupal.org 26 Jun '24

26 Jun '24

View online: https://www.drupal.org/psa-2024-06-26 Date: 2024-June-26 Description: Following on from previous PSAs on 3rd Party code in the Drupal ecosystem: * PSA-2011-002 - External libraries and plugins [1] * Various 3rd Party Vulnerabilities - PSA-2019-09-04 | Drupal.org [2] It is the policy of the Drupal Security Team that site owners are responsible for monitoring and maintaining the security of 3rd party libraries. Supply chains are increasingly complex, and managing the associated risks is challenging. Website owners should actively manage their dependencies, potentially leveraging a Software Bill of Materials (SBOM) or scanner services. Other relevant tools include CSP [3] and SRI [4]. .... Concerns around polyfill.io The most recent case that has affected some contributed Drupal projects relates to the polyfill.io service. Recently, a new organization acquired and updated the polyfill.io service. The new service appears to be serving malicious content from the polyfill.io endpoints under specific circumstances. * https://thehackernews.com/2024/06/over-110000-websites-affected-by.html [5] * https://sansec.io/research/polyfill-supply-chain-attack [6] * https://github.com/polyfillpolyfill/polyfill-service/issues/2873 [7] In response to these concerns, several trusted providers of Javascript libraries are now also serving replacements for the polyfill.io service. Website owners should update their site to incorporate a newer, more reliable source for the polyfill.io files. * https://community.fastly.com/t/new-options-for-polyfill-io-users/2540 [8] * https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-yo... [9] On the other hand, the polyfills may no longer be necessary in many cases, and it may be possible to remove them from sites rather than rely on a new source. Multiple Drupal projects utilize this service in various ways; several of which require code changes and new releases to switch to alternative providers. As this relates to 3rd party libraries, the Drupal Security Team will not be issuing Security Advisories for these projects and work has been done in the public issue queues [10] (note this may not be a complete list of all affected projects). There have been significant changes in the way that 3rd party code is utilized in the Drupal ecosystem since PSA-2011-002 linked to above, but the remit of the Drupal Security Team remains limited to code hosted on drupal.org’s systems. Reported By: * Heikki Ylipaavalniemi [11] * jpieper [12] * drupalam [13] Coordinated By: * Drew Webber [14] of the Drupal Security Team * Greg Knaddison [15] of the Drupal Security Team * Cathy Theys [16] of the Drupal Security Team * Juraj Nemec [17] of the Drupal Security Team * Michael Hess [18] of the Drupal Security Team [1] https://www.drupal.org/node/1189632 [2] https://www.drupal.org/psa-2019-09-04 [3] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP [4] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity [5] https://thehackernews.com/2024/06/over-110000-websites-affected-by.html [6] https://sansec.io/research/polyfill-supply-chain-attack [7] https://github.com/polyfillpolyfill/polyfill-service/issues/2873 [8] https://community.fastly.com/t/new-options-for-polyfill-io-users/2540 [9] https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-… [10] https://www.drupal.org/project/issues/search?issue_tags=polyfill.io [11] https://www.drupal.org/user/3442607 [12] https://www.drupal.org/user/782988 [13] https://www.drupal.org/user/1076400 [14] https://www.drupal.org/user/255969 [15] https://www.drupal.org/user/36762 [16] https://www.drupal.org/user/258568 [17] https://www.drupal.org/user/272316 [18] https://www.drupal.org/user/102818

1 0

Acquia DAM - Moderately critical - Access bypass, Denial of Service - SA-CONTRIB-2024-025
by security-news＠drupal.org 05 Jun '24

05 Jun '24

View online: https://www.drupal.org/sa-contrib-2024-025 Project: Acquia DAM [1] Date: 2024-June-05 Security risk: *Moderately critical* 13∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass, Denial of Service Affected versions: <1.0.13 || >=1.1.0 <1.1.0-beta3 Description: Acquia DAM provides a connection to a third-party asset management system, allowing for images to be managed, linked to, and viewed from Drupal. In order for assets to be managed in Drupal, a site administrator must first authenticate the site to their DAM instance. The module doesn't sufficiently protect the ability to disconnect a site from DAM. While disconnected sites do not lose asset data in Drupal, it will prevent site editors from accessing the DAM until a site administrator re-authenticates the site. Some uncached media images may also fail to be fetched while disconnected. Solution: Install the latest version: * If you use the acquia_dam module for Drupal 9.4 or above, upgrade to Acquia DAM 1.0.13 [3]. * If you use a pre-release version of acquia_dam 1.1, upgrade to Acquia DAM 1.1.0-beta3 [4]. (Note: beta releases generally do not receive security coverage.) Reported By: * Matt Glaman [5] Fixed By: * Matt Glaman [6] * Greg Knaddison [7] of the Drupal Security Team * Balázs Ertl-Bakos [8] * Jakob Perry [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team * xjm [11] of the Drupal Security Team [1] https://www.drupal.org/project/acquia_dam [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/acquia_dam/releases/1.0.13 [4] https://www.drupal.org/project/acquia_dam/releases/1.1.0-beta3 [5] https://www.drupal.org/user/2416470 [6] https://www.drupal.org/user/2416470 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/1086292 [9] https://www.drupal.org/user/45640 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/65776

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news June 2024