- Security-news - lists.drupal.org

Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-core-2021-006 Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13673 Description: The Drupal core Media module provides a filter to allow embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to cross-site scripting. This advisory is not covered by Drupal Steward [3]. Also see Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028 [4] which addresses a similar vulnerability for that module. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [5]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [6]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [7]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core is not affected. Reported By: * Aaron Zinck [8] Fixed By: * Aaron Zinck [9] * Sean Blommaert [10] * Alex Bronstein [11] of the Drupal Security Team * Marcos Cano [12] * Lee Rowlands [13] of the Drupal Security Team * Adam G-H [14] * Jess [15] of the Drupal Security Team * Drew Webber [16] of the Drupal Security Team * Neil Drumm [17] of the Drupal Security Team * Brian Tofte-Schumacher [18] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/sa-contrib-2021-028 [5] https://www.drupal.org/project/drupal/releases/9.2.6 [6] https://www.drupal.org/project/drupal/releases/9.1.13 [7] https://www.drupal.org/project/drupal/releases/8.9.19 [8] https://www.drupal.org/user/518662 [9] https://www.drupal.org/user/518662 [10] https://www.drupal.org/user/545912 [11] https://www.drupal.org/user/78040 [12] https://www.drupal.org/user/1288796 [13] https://www.drupal.org/user/395439 [14] https://www.drupal.org/user/205645 [15] https://www.drupal.org/user/65776 [16] https://www.drupal.org/user/255969 [17] https://www.drupal.org/user/3064 [18] https://www.drupal.org/user/3525810

1 0

Webform - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-026
by security-news＠drupal.org 25 Aug '21

25 Aug '21

View online: https://www.drupal.org/sa-contrib-2021-026 Project: Webform [1] Date: 2021-August-25 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: The Webform module uses the CKEditor [3], library for WYSIWYG editing. CKEditor has released a security update that impacts Webform [4]. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access. For more information, see CKEditor's announcement of the release [5]. Solution: Install the latest version: * If you use the Webform module module for Drupal 8/9 upgrade to Webform 8.x-5.28 [6] or Webform 6.0.5 [7] If you are using a previous release of the Webform module you can immediately do one of several options. 1) Update Drupal 2) If you are using Composer, run drush webform:libraries:composer > DRUPAL_ROOT/composer.libraries.json and run composer update 3) If you are using Drush, run drush webform:libraries:update Learn more about updating Webform libraries. [8] Reported By: * Lee Rowlands [9] of the Drupal Security Team Fixed By: * Jacob Rockowitz [10] Coordinated By: * Greg Knaddison [11] of the Drupal Security Team * xjm [12] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/ckeditor/ckeditor4 [4] https://ckeditor.com/blog/ckeditor-4.16.2-with-browser-improvements-and-sec… [5] https://ckeditor.com/blog/ckeditor-4.16.2-with-browser-improvements-and-sec… [6] https://www.drupal.org/project/webform/releases/8.x-5.28 [7] https://www.drupal.org/project/webform/releases/6.0.5 [8] https://www.drupal.org/docs/contributed-modules/webform/webform-libraries [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/371407 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/user/65776

1 0

Admin Toolbar - Moderately critical - Cross Site Scripting, Access Bypass - SA-CONTRIB-2021-025
by security-news＠drupal.org 25 Aug '21

25 Aug '21

View online: https://www.drupal.org/sa-contrib-2021-025 Project: Admin Toolbar [1] Date: 2021-August-25 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting, Access Bypass Description: The /Admin Toolbar/ (admin_toolbar) module extends the default toolbar provided by Drupal Core with various features facilitating day-to-day editorial and administrative work. The /Admin Toolbar Search/ sub-module of this module * doesn't sanitize user input in certain cases, which leads to a Cross-Site-Scripting (XSS) vulnerability. An attacker that can create or edit certain entities, entity bundles or entity types may be able to exploit one or more Cross-Site-Scripting (XSS) vulnerabilities to target users with access to the /Admin Toolbar Search/ search box, including site admins with privileged access. * doesn't properly check access in certain cases, which may result in an information disclosure vulnerability of entity type and bundle labels. The vulnerability is mitigated by the facts, that: * the /Admin Toolbar Search/ sub-module must be enabled. * an attacker must have one of several permissions, of which at least some are commonly only assigned to either editors, site builders or administrators. * a targeted account must have permission to use the search box provided by the /Admin Toolbar Search/ sub-module. Solution: Install the latest version: * If you use admin_toolbar 3.0.0 or later, upgrade to Admin Toolbar 3.0.2 [3]. * If you use admin_toolbar 8.x-2.0 or later, upgrade to Admin Toolbar 8.x-2.5 [4]. Also see the Admin Toolbar project page [5]. Reported By: * Patrick Fey [6] Fixed By: * Romain Jarraud [7] * Patrick Fey [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/admin_toolbar [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/admin_toolbar/releases/3.0.2 [4] https://www.drupal.org/project/admin_toolbar/releases/8.x-2.5 [5] https://www.drupal.org/project/admin_toolbar/ [6] https://www.drupal.org/user/998680 [7] https://www.drupal.org/user/370706 [8] https://www.drupal.org/user/998680 [9] https://www.drupal.org/user/36762

1 0

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2021-005
by security-news＠drupal.org 12 Aug '21

12 Aug '21

View online: https://www.drupal.org/sa-core-2021-005 Project: Drupal core [1] Date: 2021-August-12 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Third-party libraries Description: The Drupal project uses the CKEditor [3], library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal [4]. Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access. For more information, see CKEditor's announcement of the release [5]. This advisory is not covered by Drupal Steward [6]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.4 [7]. * If you are using Drupal 9.1, update to Drupal 9.1.12 [8]. * If you are using Drupal 8.9, update to Drupal 8.9.18 [9]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core is not affected, although Drupal 7, 8, and 9 site owners should review their site following the protocol for managing external libraries and plugins [10] previously suggested by the Drupal Security Team, as contributed projects may use additional CKEditor plugins not packaged in Drupal core. Reported By: * Krzysztof Krzton [11] Fixed By: * xjm [12] of the Drupal Security Team * Jen Lampton [13] * Wim Leers [14] * Chris McCafferty [15] of the Drupal Security Team * James Gilliland [16] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/ckeditor/ckeditor4 [4] https://ckeditor.com/blog/ckeditor-4.16.2-with-browser-improvements-and-sec… [5] https://ckeditor.com/blog/ckeditor-4.16.2-with-browser-improvements-and-sec… [6] https://www.drupal.org/steward [7] https://www.drupal.org/project/drupal/releases/9.2.4 [8] https://www.drupal.org/project/drupal/releases/9.1.12 [9] https://www.drupal.org/project/drupal/releases/8.9.18 [10] https://www.drupal.org/psa-2011-002 [11] https://www.drupal.org/user/3618903 [12] https://www.drupal.org/user/65776 [13] https://www.drupal.org/user/85586 [14] https://www.drupal.org/user/99777 [15] https://www.drupal.org/user/1850070 [16] https://www.drupal.org/user/48673

1 0

Drupal 8 and 9 core release on August 12, 2021 - PSA-2021-08-09
by security-news＠drupal.org 09 Aug '21

09 Aug '21

View online: https://www.drupal.org/psa-2021-08-09 Date: 2021-August-09 Description: The Drupal Security Team will be coordinating a security release for Drupal core 8.9, 9.1, and 9.2 this week on *Thursday, August 12, 2021*. We are issuing this PSA in advance because August 12, 2021 is not a security window in the regular Drupal security release window schedule [1], so there would not normally be any security release on this date. The Drupal core release will be made between 16:00 – 21:00 UTC (noon – 5:00pm EDT). It is rated as moderately critical and will be an update to a vendor library only. Drupal 7 core is not affected, although Drupal 7 site owners should review their site following the protocol for managing external libraries and plugins [2] previously suggested by the Drupal Security Team. [1] https://www.drupal.org/node/1173280 [2] https://www.drupal.org/psa-2011-002

1 0

Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2021-024
by security-news＠drupal.org 28 Jul '21

28 Jul '21

View online: https://www.drupal.org/sa-contrib-2021-024 Project: Pages Restriction Access [1] Date: 2021-July-28 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This project enables administrators to restrict access from anonymous and regular users to pre-defined pages. The administration routes used by the project lacked proper permissions, allowing untrusted users to access, create and modify the module's settings. Solution: Install the latest version: * If you use the Pages Restriction Access for Drupal 8.x, upgrade to Pages Restriction Access for Drupal 8.x-1.4 [3] Reported By: * Murilo Marchi [4] Fixed By: * Renato Gonçalves H [5] * Vitor Grillo [6] Coordinated By: * Chris McCafferty [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/pages_restriction [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/pages_restriction/releases/8.x-1.4 [4] https://www.drupal.org/user/3681454 [5] https://www.drupal.org/user/3326031 [6] https://www.drupal.org/user/3436121 [7] https://www.drupal.org/u/cilefen [8] https://www.drupal.org/user/36762

1 0

Form mode manager - Moderately critical - Access bypass - SA-CONTRIB-2021-023
by security-news＠drupal.org 21 Jul '21

21 Jul '21

View online: https://www.drupal.org/sa-contrib-2021-023 Project: Form mode manager [1] Date: 2021-July-21 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Proof/TD:Default [2] Vulnerability: Access bypass Description: This module provides a user interface that allows the implementation and use of /Form modes/ without custom development. The module does not sufficiently respect access restrictions to entity forms for routes it creates to use specific form modes. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to use a specific form mode, for example use X form mode. Solution: Install the latest version: * If you use the Form mode manager module 8.x-1.x series for Drupal 8, upgrade to form_mode_manager 8.x-1.4 [3]. Reported By: * Byron Duvall [4] * Jason Partyka [5] * Bec [6] Fixed By: * Byron Duvall [7] * Derek Wright [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * Damien McKenna [10] of the Drupal Security Team [1] https://www.drupal.org/project/form_mode_manager [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/form_mode_manager/releases/8.x-1.4 [4] https://www.drupal.org/user/1279040 [5] https://www.drupal.org/user/344048 [6] https://www.drupal.org/user/81067 [7] https://www.drupal.org/user/1279040 [8] https://www.drupal.org/user/46549 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/108450

1 0

Drupal core - Critical - Drupal core - Critical - Third-party libraries - SA-CORE-2021-004
by security-news＠drupal.org 21 Jul '21

21 Jul '21

View online: https://www.drupal.org/sa-core-2021-004 Project: Drupal core [1] Date: 2021-July-21 Security risk: *Critical* 15∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Drupal core - Critical - Third-party libraries CVE IDs: CVE-2021-32610 Description: The Drupal project uses the pear Archive_Tar library, which has released a security update that impacts Drupal. The vulnerability is mitigated by the fact that Drupal core's use of the Archive_Tar library is not vulnerable, as it does not permit symlinks. Exploitation may be possible if contrib or custom code uses the library to extract tar archives (for example .tar, .tar.gz, .bz2, or .tlz) which come from a potentially untrusted source. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.2 [4]. * If you are using Drupal 9.1, update to Drupal 9.1.11 [5]. * If you are using Drupal 8.9, update to Drupal 8.9.17 [6]. * If you are using Drupal 7, update to Drupal 7.82 [7]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Reported By: * Drew Webber [8] of the Drupal Security Team Fixed By: * Drew Webber [9] of the Drupal Security Team * michieltcs [10] * Heine [11] of the Drupal Security Team * Jess [12] of the Drupal Security Team * Lee Rowlands [13] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/9.2.2 [5] https://www.drupal.org/project/drupal/releases/9.1.11 [6] https://www.drupal.org/project/drupal/releases/8.9.17 [7] https://www.drupal.org/project/drupal/releases/7.82 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/user/255969 [10] https://www.drupal.org/user/3587972 [11] https://www.drupal.org/user/17943 [12] https://www.drupal.org/user/65776 [13] https://www.drupal.org/user/395439

1 0

Block Content Revision UI - Moderately critical - Access bypass - SA-CONTRIB-2021-022
by security-news＠drupal.org 30 Jun '21

30 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-022 Project: Block Content Revision UI [1] Date: 2021-June-30 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module provides a revision UI for Block Content entities. The module doesn't sufficiently respect access restrictions to certain entities when used in conjunction with specific modules. This vulnerability is mitigated by the fact that an attacker must have a role with any of the permissions provided by Block Content Revision UI, and another affected module must be enabled. Solution: Install the latest version: * If you use the Block Content Revision UI module for Drupal 8.x, upgrade to Block Content Revision UI 2.127.2 [3] Reported By: * Adam [4] Fixed By: * Adam [5] * Michael Strelan [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/block_content_revision_ui [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/block_content_revision_ui/releases/2.127.2 [4] https://www.drupal.org/user/1036766 [5] https://www.drupal.org/user/1036766 [6] https://www.drupal.org/user/314289 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450

1 0

Linky Revision UI - Moderately critical - Access bypass - SA-CONTRIB-2021-021
by security-news＠drupal.org 30 Jun '21

30 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-021 Project: Linky Revision UI [1] Date: 2021-June-30 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module provides a revision UI for Linky entities. The module doesn't sufficiently respect access restrictions to certain entities when used in conjunction with specific modules. This vulnerability is mitigated by the fact that an attacker must have a role with any of the permissions provided by Linky Revision UI, and another affected module must be enabled. Solution: Install the latest version: * If you use the Linky Revision UI module for Drupal 8.x, upgrade to Linky Revision UI 2.127.2 [3] Reported By: * Adam [4] Fixed By: * Adam [5] * Michael Strelan [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/linky_revision_ui [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/linky_revision_ui/releases/2.127.2 [4] https://www.drupal.org/user/1036766 [5] https://www.drupal.org/user/1036766 [6] https://www.drupal.org/user/314289 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450

1 0