Security-news

security-news@drupal.org

1 participants
1782 discussions

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2021-005
by security-news＠drupal.org 12 Aug '21

12 Aug '21

View online: https://www.drupal.org/sa-core-2021-005 Project: Drupal core [1] Date: 2021-August-12 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Third-party libraries Description: The Drupal project uses the CKEditor [3], library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal [4]. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access. For more information, see CKEditor's announcement of the release [5]. This advisory is not covered by Drupal Steward [6]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.4 [7]. * If you are using Drupal 9.1, update to Drupal 9.1.12 [8]. * If you are using Drupal 8.9, update to Drupal 8.9.18 [9]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core is not affected, although Drupal 7, 8, and 9 site owners should review their site following the protocol for managing external libraries and plugins [10] previously suggested by the Drupal Security Team, as contributed projects may use additional CKEditor plugins not packaged in Drupal core. Reported By: * Krzysztof Krzton [11] Fixed By: * xjm [12] of the Drupal Security Team * Jen Lampton [13] * Wim Leers [14] * Chris McCafferty [15] of the Drupal Security Team * James Gilliland [16] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/ckeditor/ckeditor4 [4] https://ckeditor.com/blog/ckeditor-4.16.2-with-browser-improvements-and-sec… [5] https://ckeditor.com/blog/ckeditor-4.16.2-with-browser-improvements-and-sec… [6] https://www.drupal.org/steward [7] https://www.drupal.org/project/drupal/releases/9.2.4 [8] https://www.drupal.org/project/drupal/releases/9.1.12 [9] https://www.drupal.org/project/drupal/releases/8.9.18 [10] https://www.drupal.org/psa-2011-002 [11] https://www.drupal.org/user/3618903 [12] https://www.drupal.org/user/65776 [13] https://www.drupal.org/user/85586 [14] https://www.drupal.org/user/99777 [15] https://www.drupal.org/user/1850070 [16] https://www.drupal.org/user/48673

1 0

Drupal 8 and 9 core release on August 12, 2021 - PSA-2021-08-09
by security-news＠drupal.org 09 Aug '21

09 Aug '21

View online: https://www.drupal.org/psa-2021-08-09 Date: 2021-August-09 Description: The Drupal Security Team will be coordinating a security release for Drupal core 8.9, 9.1, and 9.2 this week on *Thursday, August 12, 2021*. We are issuing this PSA in advance because August 12, 2021 is not a security window in the regular Drupal security release window schedule [1], so there would not normally be any security release on this date. The Drupal core release will be made between 16:00 – 21:00 UTC (noon – 5:00pm EDT). It is rated as moderately critical and will be an update to a vendor library only. Drupal 7 core is not affected, although Drupal 7 site owners should review their site following the protocol for managing external libraries and plugins [2] previously suggested by the Drupal Security Team. [1] https://www.drupal.org/node/1173280 [2] https://www.drupal.org/psa-2011-002

1 0

Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2021-024
by security-news＠drupal.org 28 Jul '21

28 Jul '21

View online: https://www.drupal.org/sa-contrib-2021-024 Project: Pages Restriction Access [1] Date: 2021-July-28 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This project enables administrators to restrict access from anonymous and regular users to pre-defined pages. The administration routes used by the project lacked proper permissions, allowing untrusted users to access, create and modify the module's settings. Solution: Install the latest version: * If you use the Pages Restriction Access for Drupal 8.x, upgrade to Pages Restriction Access for Drupal 8.x-1.4 [3] Reported By: * Murilo Marchi [4] Fixed By: * Renato Gonçalves H [5] * Vitor Grillo [6] Coordinated By: * Chris McCafferty [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/pages_restriction [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/pages_restriction/releases/8.x-1.4 [4] https://www.drupal.org/user/3681454 [5] https://www.drupal.org/user/3326031 [6] https://www.drupal.org/user/3436121 [7] https://www.drupal.org/u/cilefen [8] https://www.drupal.org/user/36762

1 0

Form mode manager - Moderately critical - Access bypass - SA-CONTRIB-2021-023
by security-news＠drupal.org 21 Jul '21

21 Jul '21

View online: https://www.drupal.org/sa-contrib-2021-023 Project: Form mode manager [1] Date: 2021-July-21 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Proof/TD:Default [2] Vulnerability: Access bypass Description: This module provides a user interface that allows the implementation and use of /Form modes/ without custom development. The module does not sufficiently respect access restrictions to entity forms for routes it creates to use specific form modes. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to use a specific form mode, for example use X form mode. Solution: Install the latest version: * If you use the Form mode manager module 8.x-1.x series for Drupal 8, upgrade to form_mode_manager 8.x-1.4 [3]. Reported By: * Byron Duvall [4] * Jason Partyka [5] * Bec [6] Fixed By: * Byron Duvall [7] * Derek Wright [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * Damien McKenna [10] of the Drupal Security Team [1] https://www.drupal.org/project/form_mode_manager [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/form_mode_manager/releases/8.x-1.4 [4] https://www.drupal.org/user/1279040 [5] https://www.drupal.org/user/344048 [6] https://www.drupal.org/user/81067 [7] https://www.drupal.org/user/1279040 [8] https://www.drupal.org/user/46549 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/108450

1 0

Drupal core - Critical - Drupal core - Critical - Third-party libraries - SA-CORE-2021-004
by security-news＠drupal.org 21 Jul '21

21 Jul '21

View online: https://www.drupal.org/sa-core-2021-004 Project: Drupal core [1] Date: 2021-July-21 Security risk: *Critical* 15∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Drupal core - Critical - Third-party libraries CVE IDs: CVE-2021-32610 Description: The Drupal project uses the pear Archive_Tar library, which has released a security update that impacts Drupal. The vulnerability is mitigated by the fact that Drupal core's use of the Archive_Tar library is not vulnerable, as it does not permit symlinks. Exploitation may be possible if contrib or custom code uses the library to extract tar archives (for example .tar, .tar.gz, .bz2, or .tlz) which come from a potentially untrusted source. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.2 [4]. * If you are using Drupal 9.1, update to Drupal 9.1.11 [5]. * If you are using Drupal 8.9, update to Drupal 8.9.17 [6]. * If you are using Drupal 7, update to Drupal 7.82 [7]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Reported By: * Drew Webber [8] of the Drupal Security Team Fixed By: * Drew Webber [9] of the Drupal Security Team * michieltcs [10] * Heine [11] of the Drupal Security Team * Jess [12] of the Drupal Security Team * Lee Rowlands [13] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/9.2.2 [5] https://www.drupal.org/project/drupal/releases/9.1.11 [6] https://www.drupal.org/project/drupal/releases/8.9.17 [7] https://www.drupal.org/project/drupal/releases/7.82 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/user/255969 [10] https://www.drupal.org/user/3587972 [11] https://www.drupal.org/user/17943 [12] https://www.drupal.org/user/65776 [13] https://www.drupal.org/user/395439

1 0

Block Content Revision UI - Moderately critical - Access bypass - SA-CONTRIB-2021-022
by security-news＠drupal.org 30 Jun '21

30 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-022 Project: Block Content Revision UI [1] Date: 2021-June-30 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module provides a revision UI for Block Content entities. The module doesn't sufficiently respect access restrictions to certain entities when used in conjunction with specific modules. This vulnerability is mitigated by the fact that an attacker must have a role with any of the permissions provided by Block Content Revision UI, and another affected module must be enabled. Solution: Install the latest version: * If you use the Block Content Revision UI module for Drupal 8.x, upgrade to Block Content Revision UI 2.127.2 [3] Reported By: * Adam [4] Fixed By: * Adam [5] * Michael Strelan [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/block_content_revision_ui [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/block_content_revision_ui/releases/2.127.2 [4] https://www.drupal.org/user/1036766 [5] https://www.drupal.org/user/1036766 [6] https://www.drupal.org/user/314289 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450

1 0

Linky Revision UI - Moderately critical - Access bypass - SA-CONTRIB-2021-021
by security-news＠drupal.org 30 Jun '21

30 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-021 Project: Linky Revision UI [1] Date: 2021-June-30 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module provides a revision UI for Linky entities. The module doesn't sufficiently respect access restrictions to certain entities when used in conjunction with specific modules. This vulnerability is mitigated by the fact that an attacker must have a role with any of the permissions provided by Linky Revision UI, and another affected module must be enabled. Solution: Install the latest version: * If you use the Linky Revision UI module for Drupal 8.x, upgrade to Linky Revision UI 2.127.2 [3] Reported By: * Adam [4] Fixed By: * Adam [5] * Michael Strelan [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/linky_revision_ui [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/linky_revision_ui/releases/2.127.2 [4] https://www.drupal.org/user/1036766 [5] https://www.drupal.org/user/1036766 [6] https://www.drupal.org/user/314289 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450

1 0

Apigee Edge - Moderately critical - Access bypass - SA-CONTRIB-2021-020
by security-news＠drupal.org 30 Jun '21

30 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-020 Project: Apigee Edge [1] Date: 2021-June-30 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The Apigee Edge module allows connecting a Drupal site to Apigee Edge in order to build a developer portal. The module did not properly validate user access for data creation in certain circumstances. Solution: Install the latest version: * If you use the apigee_edge module for Drupal 8.x, upgrade to Apigee Edge module 8.x-1.2 or later. Note that the 8.x-1.2 release is old and superseded due to SA-CONTRIB-2020-028 . Users of the module should upgrade to a version including or newer than 8.x-1.12. Reported By: * trebde [3] Fixed By: * trebde [4] * gitesh.koli [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Damien McKenna [7] of the Drupal Security Team [1] https://www.drupal.org/project/apigee_edge [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/user/3629605 [4] https://www.drupal.org/user/3629605 [5] https://www.drupal.org/user/673858 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/108450

1 0

Drupal 8 end-of-life on November 2, 2021 (four months from now) - PSA-2021-2021-06-29
by security-news＠drupal.org 29 Jun '21

29 Jun '21

View online: https://www.drupal.org/psa-2021-2021-06-29 Version: 8.9.x-dev Date: 2021-June-29 Description: *Drupal 8 will reach its end-of-life on November 2, 2021*, before the release of Drupal 9.3.0, due to Symfony 3's end-of-life [1]. If you are using Drupal 8, *you must upgrade to Drupal 9.2 before November to keep your site secure*. (Drupal 9.1 security coverage ends shortly after the Drupal 8 end-of-life, so updating to 9.2 directly is best.) There is no vendor extended support program for Drupal 8. Solution: .... How do I upgrade my Drupal 8 site to Drupal 9? The Drupal 8 to Drupal 9 upgrade process is much easier than previous major-version upgrades. There are many automated tools available to assist with the upgrade. Learn more about upgrading your Drupal 8 site to Drupal 9 [2]. .. What if a module I need doesn't have a Drupal 9 release? Many modules can be upgraded automatically. Check the module's issue queue for an issue created by "Project Update Bot". 1) If the "Project Update Bot" issue is not yet marked "Reviewed and Tested by the Community" ("RTBC"), review and test whether the module works for you on Drupal 9 with that patch applied to its code. * If the issue is set to "Needs review" and your testing does not encounter any problems, you can mark the issue RTBC, along with a comment explaining what you tested and how. * Otherwise, if it does not work or causes bugs that didn't happen before, mark the issue "Needs work" explaining what did not work with the Drupal 9 patch. 2) If the existing issue is /already/ "Reviewed & Tested by the Community", test it yourself, and comment on the issue reporting what testing you did. Consider using the maintainer's contact form to reach out to them asking them to make a Drupal 9 release. 3) If you have maintained contributed projects before and the patch has been RTBC for at least two weeks, consider taking over maintenance of the module [3]. Otherwise, if you work with an organization that provides Drupal services, ask that organization to consider taking over maintenance of the module. If you cannot find anyone to maintain the module, try using the patch directly with composer [4]. The Drupal Association will also be taking additional steps to help with the creation of Drupal-9-compatible releases in the coming months. .... What about Drupal 7? Drupal 7 will still have community-based security coverage until November 28, 2022 [5]. The paid Drupal 7 Vendor Extended Support program [6] will continue until November 2025. [1] https://symfony.com/releases/3.4 [2] https://www.drupal.org/docs/upgrading-drupal/how-to-prepare-your-drupal-7-o… [3] https://www.drupal.org/docs/develop/managing-a-drupalorg-theme-module-or-di… [4] https://www.drupal.org/docs/upgrading-drupal/upgrading-from-drupal-8-to-dru… [5] https://www.drupal.org/psa-2020-06-24 [6] https://www.drupal.org/project/d7es

1 0

Opigno group manager - Less critical - UI redressing (clickjacking) - SA-CONTRIB-2021-019
by security-news＠drupal.org 23 Jun '21

23 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-019 Project: Opigno group manager [1] Date: 2021-June-23 Security risk: *Less critical* 9∕25 AC:Complex/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: UI redressing (clickjacking) Description: This project is related to Opigno LMS distribution. It implements the group manager in the Opigno LMS. The module does not set X-Frame-Options and blocks ability of other modules (e.g Security Kit [3]) to add them, leaving it vulnerable to Clickjacking. Solution: Install the latest version: * If you use the Opigno group manager module for Drupal 8.x, upgrade to a version greater than 8.x-1.7 Opigno group manager 8.x-1.8 or later [4] The issue was fixed in public but needed a security advisory. Users of the module are encouraged to upgrade to at least 8.x-1.8 or a later version to gain protection against this weakness. Reported By: * Bryan Butler [5] Fixed By: * James Aparicio [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/opigno_group_manager [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/seckit [4] https://www.drupal.org/project/opigno_group_manager/releases/8.x-1.8 [5] https://www.drupal.org/user/3591325 [6] https://www.drupal.org/user/2547544 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news