January 2025 - Security-news - lists.drupal.org

Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002
by security-news＠drupal.org 08 Jan '25

08 Jan '25

View online: https://www.drupal.org/sa-contrib-2025-002 Project: Profile Private [1] Date: 2025-January-08 Security risk: *Critical* 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] Reported By: * Dezső Biczó [5] Coordinated By: * Ivo Van Geertruyen [6] of the Drupal Security Team * Cathy Theys [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/profile_private [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://security.drupal.org/user/86953 [6] https://www.drupal.org/u/mrbaileys [7] https://www.drupal.org/u/yesct [8] https://security.drupal.org/user/27

1 0

Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001
by security-news＠drupal.org 08 Jan '25

08 Jan '25

View online: https://www.drupal.org/sa-contrib-2025-001 Project: Email TFA [1] Date: 2025-January-08 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.3 Description: This module enables you to do Two-Factor Authentication by email, using a user registered email to send a verification code to the user's email every time the user tries to log in to your site. The module did not sufficiently protect against brute force attacks, allowing an attacker to bypass the second factor. This vulnerability is mitigated by the fact the attacker must be able to present the username and first factor (i.e. password). Solution: Install the latest version: * If you use the Email TFA module, upgrade to Email TFA 2.0.3 [3] Reported By: * Ursin Cola [4] Fixed By: * Ursin Cola [5] * abdulaziz zaid [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team [1] https://www.drupal.org/project/email_tfa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/email_tfa/releases/2.0.3 [4] https://www.drupal.org/user/679260 [5] https://www.drupal.org/user/679260 [6] https://www.drupal.org/user/3585656 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/272316

1 0

Drupal 7 End of Life - PSA-2025-01-06
by security-news＠drupal.org 08 Jan '25

08 Jan '25

View online: https://www.drupal.org/psa-2025-01-06 Date: 2025-January-06 Description: Drupal core version 7 has reached end of life, and is no longer community supported on Drupal.org. This means that new releases of Drupal 7 core and contributed projects will no longer happen on Drupal.org and community support is no longer provided. *What this means for you:* 1) Any vulnerabilities that impact Drupal 7 may be released and made public without Security Advisories or warnings. Please continue to follow the process outlined in: Report a security issue [1] 2) Drupal 7 will no longer be supported. There will be no more core commits on Drupal 7.x to the official repository. The community will no longer be creating new Drupal 7 releases, fixing bugs in existing projects, writing documentation, etc. around Drupal 7. 3) The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 and Drupal-7-compatible contributed projects. 4) All Drupal 7 releases on project pages will be flagged as not supported. At some point in the future, update status and packages.drupal.org/7 will stop working for Drupal 7 sites. *Solution:* You can learn about upgrading Drupal and migrations [2] or read about other options [3]. [1] https://www.drupal.org/docs/develop/issues/issue-procedures-and-etiquette/r… [2] https://www.drupal.org/about/drupal-7/d7eol/diy [3] https://www.drupal.org/about/drupal-7/d7eol

1 0