- Security-news - lists.drupal.org

SA-CONTRIB-2012-093 - Node Embed - Access Bypass
by security-news＠drupal.org 06 Jun '12

06 Jun '12

View online: http://drupal.org/node/1619824 * Advisory ID: DRUPAL-SA-CONTRIB-2012-093 * Project: Node Embed [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-June-06 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Node Embed gives content editors an interface for selecting and embedding nodes using a WYSIWYG editor. The interface for selecting nodes is a page that had no access check, allowing users to view node titles they might not have access to. This issue only affects your site if you have unpublished nodes or use a node access module to restrict content access from some users. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Node Embed 6.x-1.x versions prior to 6.x-1.5. * Node Embed 7.x-1.x versions prior to 7.x-1.0. Drupal core is not affected. If you do not use the contributed Node Embed [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Node Embed module for Drupal 6.x, upgrade to Node Embed 6.x-1.5 [4] * If you use the Node Embed module for Drupal 7.x, upgrade to Node Embed 7.x-1.0 [5] Also see the Node Embed [6] project page. -------- REPORTED BY --------------------------------------------------------- * Paul Aumer-Ryan [7] -------- FIXED BY ------------------------------------------------------------ * Scott Reynen [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/node_embed [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/node_embed [4] http://drupal.org/node/1618430 [5] http://drupal.org/node/1618428 [6] http://drupal.org/project/node_embed [7] http://drupal.org/user/422353 [8] http://drupal.org/user/109890 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-092 - Organic Groups - Cross Site Scripting (XSS) and Access Bypass
by security-news＠drupal.org 06 Jun '12

06 Jun '12

View online: http://drupal.org/node/1619810 * Advisory ID: DRUPAL-SA-CONTRIB-2012-092 * Project: Organic groups [1] (third-party module) * Version: 6.x * Date: 2012-June-06 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Access bypass -------- DESCRIPTION --------------------------------------------------------- The Organic Groups module enables users to create and manage their own 'groups'. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves. .... Cross Site Scripting The module doesn't sufficiently filter user supplied text when used in connection with the Vertical Tabs module. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create or edit a group title and the site must have the contributed Vertical Tabs module installed and the Vertical Tabs configuration must include the Organic Group select area (this is the default configuration when Vertical Tabs is enabled). .... Access bypass The module's default views do not sufficiently check the Drupal core permission to /access content/. This vulnerability is mitigated by the fact that a site must have removed the "access content" permission to all users. This is not a common configuration. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Organic groups 6.x-2.x versions prior to 6.x-2.4. Drupal core is not affected. If you do not use the contributed Organic groups [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Organic groups module for Drupal 6.x, upgrade to Organic Groups 6.x-2.4 [4] Also see the Organic groups [5] project page. -------- REPORTED BY --------------------------------------------------------- * Ezra Barnett Gildesgame [6] identified the Cross Site Scripting issue * Fox [7] identified the Access Bypass issue -------- FIXED BY ------------------------------------------------------------ * Adam Ross [8] the module maintainer * Fox [9] * Greg Knaddison [10] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [11] of the Drupal Security Team * Forest Monsen [12] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. [1] http://drupal.org/project/og [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/og [4] http://drupal.org/node/1619736 [5] http://drupal.org/project/og [6] http://drupal.org/user/69959 [7] http://drupal.org/user/426416 [8] http://drupal.org/user/346868 [9] http://drupal.org/user/426416 [10] http://drupal.org/user/36762 [11] http://drupal.org/user/36762 [12] http://drupal.org/user/181798 [13] http://drupal.org/contact [14] http://drupal.org/security-team [15] http://drupal.org/writing-secure-code [16] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-091 - Token Authentication - Access bypass
by security-news＠drupal.org 06 Jun '12

06 Jun '12

View online: http://drupal.org/node/1619808 * Advisory ID: DRUPAL-SA-CONTRIB-2012-091 * Project: Tokenauth [1] (third-party module) * Version: 6.x * Date: 2012-June-06 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Token Authentication module provides a token for use in the URL to authenticate users to a site. Under certain uncommon situations, the module may not revert a user's session properly. Depending on how tokenauth is used, this could result in subsequent requests being performed as a user with additional privileges when they shouldn't. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Tokenauth 6.x-1.x versions prior to 6.x-1.7. Drupal core is not affected. If you do not use the contributed Token Authentication [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Tokenauth module for Drupal 6.x, upgrade to Tokenauth 6.x-1.7 [4] Also see the Tokenauth [5] project page. -------- REPORTED BY --------------------------------------------------------- * John Morahan [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Adam Ross [7] the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/tokenauth [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/tokenauth [4] http://drupal.org/node/1618476 [5] http://drupal.org/project/tokenauth [6] http://drupal.org/user/58170 [7] http://drupal.org/user/346868 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-090 - File depot - Session Management Vulnerability
by security-news＠drupal.org 30 May '12

30 May '12

View online: http://drupal.org/node/1608864 * Advisory ID: DRUPAL-SA-CONTRIB-2012-090 * Project: filedepot [1] (third-party module) * Version: 6.x * Date: 2012-May-30 * Security risk: Critical [2] * Exploitable from: remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The filedepot module is a Document Management module. It fulfills the need for an integrated file management module supporting role and user based security. Documents can be saved outside the Drupal public directory to protect documents for safe access and distribution. The module has a Session Management Vulnerability that caused Internet Explorer browser users to switch users if they uploaded a file using another browser from the same IP address (Internet Protocol address). This vulnerability is mitigated by the fact that it only occurred with Internet Explorer and when multiple sessions where running from the same desktop / IP address. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * filedepot 6.x-1.x versions prior to 6.x-1.3. Drupal core is not affected. If you do not use the contributed filedepot [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the filedepot for Drupal 6.x, upgrade to filedepot 6.x-1.3 [4] Also see the filedepot [5] project page. -------- REPORTED BY --------------------------------------------------------- * dolu [6] -------- FIXED BY ------------------------------------------------------------ * Blaine Lang [7] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/filedepot [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/filedepot [4] http://drupal.org/node/1598782 [5] http://drupal.org/project/filedepot [6] http://drupal.org/user/374670 [7] http://drupal.org/user/726382 [8] http://drupal.org/user/36762 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-089 - Counter - SQL Injection (unsupported)
by security-news＠drupal.org 30 May '12

30 May '12

View online: http://drupal.org/node/1608854 * Advisory ID: DRUPAL-SA-CONTRIB-2012-089 * Project: Counter [1] (third-party module) * Version: 6.x * Date: 2012-May-30 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: SQL Injection -------- DESCRIPTION --------------------------------------------------------- Counter module counts how many visitors on your website. This module provides real time counting with all data saved to the database. The module doesn't sufficiently filter user supplied text when recording visits to the database which leads to a SQL Injection vulnerability. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * All Counter module versions. Drupal core is not affected. If you do not use the contributed Counter [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you currently use the Counter module you should disable the module. Also see the Counter [4] project page. -------- REPORTED BY --------------------------------------------------------- * Balazs Dianiska [5] -------- FIXED BY ------------------------------------------------------------ The issue was not fixed. -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [6] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. [1] http://drupal.org/project/counter [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/counter [4] http://drupal.org/project/counter [5] http://drupal.org/user/58645 [6] http://drupal.org/user/102818 [7] http://drupal.org/contact [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-088 - Mobile Tools - Cross Site Scripting (XSS)
by security-news＠drupal.org 30 May '12

30 May '12

View online: http://drupal.org/node/1608828 * Advisory ID: DRUPAL-SA-CONTRIB-2012-088 * Project: Mobile Tools [1] (third-party module) * Version: 6.x * Date: 2012-May-30 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Mobile Tools provides Drupal developers with some tools to assist in making a site mobile. The module contains several persistent cross site scripting (XSS) vulnerabilities due to the fact that it fails to sanitize user supplied values before display. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Mobile Tools 6.x-2.x versions prior to 6.x-2.3 Drupal core is not affected. If you do not use the contributed Mobile Tools [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Mobile Tools module for Drupal 6.x, upgrade to Mobile Tools 6.x-2.3 [4] Also see the Mobile Tools [5] project page. -------- REPORTED BY --------------------------------------------------------- * Justin Klein Keane [6] -------- FIXED BY ------------------------------------------------------------ * Mathew Winstone (minorOffense) [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/mobile_tools [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/mobile_tools [4] http://drupal.org/node/1169008 [5] http://drupal.org/project/mobile_tools [6] http://drupal.org/user/302225 [7] http://drupal.org/user/129088 [8] http://drupal.org/user/102818 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-087 - Comment Moderation - Cross Site Request Forgery
by security-news＠drupal.org 30 May '12

30 May '12

View online: http://drupal.org/node/1608822 * Advisory ID: DRUPAL-SA-CONTRIB-2012-087 * Project: Comment Moderation [1] (third-party module) * Version: 6.x * Date: 2012-May-30 * Security risk: Less Critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- This module enables you to moderate comments in an accelerated way, by providing a complete interface and all useful actions in a unique page. The module doesn't sufficiently protect the publish link URL, thus a Cross Site Request Forgery (CSRF) attack against an administrator could result in unintended publishing of comments. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Comment Moderation 6.x-1.x versions prior to 6.x-1.1. Drupal core is not affected. If you do not use the contributed Comment Moderation [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Comment Moderation module for Drupal 6.x, upgrade to Comment Moderation 6.x-1.1 [4] Also see the Comment Moderation [5] project page. -------- REPORTED BY --------------------------------------------------------- * Dylan Tack (grendzy [6]) of the Drupal Security Team * Tim Wood (timwood [7]) -------- FIXED BY ------------------------------------------------------------ * David Stosik [8], one of the module maintainers -------- COORDINATED BY ------------------------------------------------------ * Members of the Drupal Security Team [9] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/comment_moderation [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/comment_moderation [4] http://drupal.org/node/1538768 [5] http://drupal.org/project/comment_moderation [6] http://drupal.org/user/96647 [7] http://drupal.org/user/457434 [8] http://drupal.org/user/49385 [9] https://security.drupal.org/team-members [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-086 - Amadou - Cross Site Scripting
by security-news＠drupal.org 30 May '12

30 May '12

View online: http://drupal.org/node/1608780 * Advisory ID: DRUPAL-SA-CONTRIB-2012-086 * Project: Amadou [1] (third-party theme) * Version: 6.x * Date: 2012-May-30 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Amadou theme outputs additional first and last classes to the list of links to help out themers. This was being done in a way that was not secure. A Cross Site Scripting (XSS) vulnerability was identified in Amadou theme's themes_links() function in the template.php file, which was fixed in the theme_links() function in Drupal 6.3 as noted in (SA-2008-044 http://drupal.org/node/280571 [3]). CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Amadou 6.x-1.x versions prior to 6.x-1.3. Drupal core is not affected. If you do not use the contributed Amadou [4] theme, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Amadou theme for Drupal 6.x, upgrade to Amadou 6.x-1.3 [5]. If you have created a custom theme with Amadou or are using Amadou as a base theme, please see below for a manual fix: The offending code on line 77 in the original template.php file: $output .= ''; Should be replaced with the following code: $output .= ' * $class)) .'>'; Also see the Amadou [6] project page. -------- REPORTED BY --------------------------------------------------------- * Peter Wolanin [7] and Matt Chapman [8] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Jason Moore [9], Amadou theme maintainer * Matt Chapman [10] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Matt Chapman [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/amadou [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/node/280571 [4] http://drupal.org/project/amadou [5] http://drupal.org/node/1608730 [6] http://drupal.org/project/amadou [7] http://drupal.org/user/49851 [8] http://drupal.org/user/143172 [9] http://drupal.org/user/149225 [10] http://drupal.org/user/143172 [11] http://drupal.org/user/143172 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-084 - Search API - Cross Site Scripting (XSS)
by security-news＠drupal.org 23 May '12

23 May '12

View online: http://drupal.org/node/1597364 * Advisory ID: DRUPAL-SA-CONTRIB-2012-084 * Project: Search API [1] (third-party module) * Version: 7.x * Date: 2012-May-23 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- CVE: Requested This module enables you to build searches using a wide range of features, data sources and backends. The module doesn't sufficiently sanitize user input in some cases when throwing exceptions or logging errors. This enables attackers to insert arbitrary data into a page by manipulating its URL. Users would have to open such a manipulated URL to see the changed content. This is only possible in some setups of Search API, specifically when users can manually enter field identifiers in some way – e.g., through an exposed Views sort or with the old Facets module. -------- VERSIONS AFFECTED --------------------------------------------------- * Search API 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed Search API [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Search API module (especially with Views, the old Facets module or other advanced search forms) for Drupal 7.x, upgrade to Search API 7.x-1.1 [4] * Run update.php to also ensure that previously stored log messages are sanitized. Also see the Search API [5] project page. -------- REPORTED BY --------------------------------------------------------- * Chuck D'Antonio [6] * Chad Oliver [7] -------- FIXED BY ------------------------------------------------------------ * Thomas Seidl [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/search_api [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/search_api [4] http://drupal.org/node/1596524 [5] http://drupal.org/project/search_api [6] http://drupal.org/user/250704 [7] http://drupal.org/user/1959622 [8] http://drupal.org/user/205582 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-085 - BrowserID - Multiple Vulnerabilities
by security-news＠drupal.org 23 May '12

23 May '12

View online: http://drupal.org/node/1597414 * Advisory ID: DRUPAL-SA-CONTRIB-2012-085 * Project: BrowserID (Mozilla Persona) [1] (third-party module) * Version: 7.x * Date: 2012-May-23 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery (results in Privilege Escalation) -------- DESCRIPTION --------------------------------------------------------- CVE: Requested The BrowserID module provides integration with BrowserID (also known as Mozilla Persona) -- a Mozilla project that lets users of your site quickly and easily log in without needing to remember a password specific to your site. The module did not sufficiently validate requests for authentication to log in, potentially allowing a Cross Site Request Forgery (CSRF) attack and introducing the possibility that logging in to a malicious site with BrowserID could give that site the ability to log in to other websites using your BrowserID identity. -------- VERSIONS AFFECTED --------------------------------------------------- * BrowserID (Mozilla Persona) 7.x-1.x versions prior to 7.x-1.3. Drupal core is not affected. If you do not use the contributed BrowserID (Mozilla Persona) [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the BrowserID module for Drupal 7.x, upgrade to BrowserID 7.x-1.3 [4] This version adds a dependency on the Session API [5] module. Make sure you install Session API /before/ upgrading to BrowserID 7.x-1.3. Also see the BrowserID (Mozilla Persona) [6] project page. -------- REPORTED BY --------------------------------------------------------- * Isaac Sukin [7], the module maintainer -------- FIXED BY ------------------------------------------------------------ * Isaac Sukin [8], the module maintainer * Greg Knaddison [9] of the Drupal Security Team * Ben Adida [10] of Mozilla -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/browserid [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/browserid [4] https://drupal.org/node/1596464 [5] https://drupal.org/project/session_api [6] http://drupal.org/project/browserid [7] https://drupal.org/user/201425 [8] https://drupal.org/user/201425 [9] https://drupal.org/user/36762 [10] https://drupal.org/user/1876458 [11] http://drupal.org/user/36762 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0