- Security-news - lists.drupal.org

Apigee Edge - Moderately critical - Access bypass - SA-CONTRIB-2021-020
by security-news＠drupal.org 30 Jun '21

30 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-020 Project: Apigee Edge [1] Date: 2021-June-30 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The Apigee Edge module allows connecting a Drupal site to Apigee Edge in order to build a developer portal. The module did not properly validate user access for data creation in certain circumstances. Solution: Install the latest version: * If you use the apigee_edge module for Drupal 8.x, upgrade to Apigee Edge module 8.x-1.2 or later. Note that the 8.x-1.2 release is old and superseded due to SA-CONTRIB-2020-028 . Users of the module should upgrade to a version including or newer than 8.x-1.12. Reported By: * trebde [3] Fixed By: * trebde [4] * gitesh.koli [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Damien McKenna [7] of the Drupal Security Team [1] https://www.drupal.org/project/apigee_edge [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/user/3629605 [4] https://www.drupal.org/user/3629605 [5] https://www.drupal.org/user/673858 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/108450

1 0

Drupal 8 end-of-life on November 2, 2021 (four months from now) - PSA-2021-2021-06-29
by security-news＠drupal.org 30 Jun '21

30 Jun '21

View online: https://www.drupal.org/psa-2021-2021-06-29 Version: 8.9.x-dev Date: 2021-June-29 Description: *Drupal 8 will reach its end-of-life on November 2, 2021*, before the release of Drupal 9.3.0, due to Symfony 3's end-of-life [1]. If you are using Drupal 8, *you must upgrade to Drupal 9.2 before November to keep your site secure*. (Drupal 9.1 security coverage ends shortly after the Drupal 8 end-of-life, so updating to 9.2 directly is best.) There is no vendor extended support program for Drupal 8. Solution: .... How do I upgrade my Drupal 8 site to Drupal 9? The Drupal 8 to Drupal 9 upgrade process is much easier than previous major-version upgrades. There are many automated tools available to assist with the upgrade. Learn more about upgrading your Drupal 8 site to Drupal 9 [2]. .. What if a module I need doesn't have a Drupal 9 release? Many modules can be upgraded automatically. Check the module's issue queue for an issue created by "Project Update Bot". 1) If the "Project Update Bot" issue is not yet marked "Reviewed and Tested by the Community" ("RTBC"), review and test whether the module works for you on Drupal 9 with that patch applied to its code. * If the issue is set to "Needs review" and your testing does not encounter any problems, you can mark the issue RTBC, along with a comment explaining what you tested and how. * Otherwise, if it does not work or causes bugs that didn't happen before, mark the issue "Needs work" explaining what did not work with the Drupal 9 patch. 2) If the existing issue is /already/ "Reviewed & Tested by the Community", test it yourself, and comment on the issue reporting what testing you did. Consider using the maintainer's contact form to reach out to them asking them to make a Drupal 9 release. 3) If you have maintained contributed projects before and the patch has been RTBC for at least two weeks, consider taking over maintenance of the module [3]. Otherwise, if you work with an organization that provides Drupal services, ask that organization to consider taking over maintenance of the module. If you cannot find anyone to maintain the module, try using the patch directly with composer [4]. The Drupal Association will also be taking additional steps to help with the creation of Drupal-9-compatible releases in the coming months. .... What about Drupal 7? Drupal 7 will still have community-based security coverage until November 28, 2022 [5]. The paid Drupal 7 Vendor Extended Support program [6] will continue until November 2025. [1] https://symfony.com/releases/3.4 [2] https://www.drupal.org/docs/upgrading-drupal/how-to-prepare-your-drupal-7-o… [3] https://www.drupal.org/docs/develop/managing-a-drupalorg-theme-module-or-di… [4] https://www.drupal.org/docs/upgrading-drupal/upgrading-from-drupal-8-to-dru… [5] https://www.drupal.org/psa-2020-06-24 [6] https://www.drupal.org/project/d7es

1 0

Opigno group manager - Less critical - UI redressing (clickjacking) - SA-CONTRIB-2021-019
by security-news＠drupal.org 23 Jun '21

23 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-019 Project: Opigno group manager [1] Date: 2021-June-23 Security risk: *Less critical* 9∕25 AC:Complex/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: UI redressing (clickjacking) Description: This project is related to Opigno LMS distribution. It implements the group manager in the Opigno LMS. The module does not set X-Frame-Options and blocks ability of other modules (e.g Security Kit [3]) to add them, leaving it vulnerable to Clickjacking. Solution: Install the latest version: * If you use the Opigno group manager module for Drupal 8.x, upgrade to a version greater than 8.x-1.7 Opigno group manager 8.x-1.8 or later [4] The issue was fixed in public but needed a security advisory. Users of the module are encouraged to upgrade to at least 8.x-1.8 or a later version to gain protection against this weakness. Reported By: * Bryan Butler [5] Fixed By: * James Aparicio [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/opigno_group_manager [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/seckit [4] https://www.drupal.org/project/opigno_group_manager/releases/8.x-1.8 [5] https://www.drupal.org/user/3591325 [6] https://www.drupal.org/user/2547544 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450

1 0

Opigno Learning path - Less critical - UI redressing (clickjacking) - SA-CONTRIB-2021-018
by security-news＠drupal.org 23 Jun '21

23 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-018 Project: Opigno Learning path [1] Date: 2021-June-23 Security risk: *Less critical* 9∕25 AC:Complex/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: UI redressing (clickjacking) Description: This project is related to Opigno LMS distribution. It implements the learning path, that combines together in a very flexible way the differents steps of a training in Opigno LMS. The module does not set X-Frame-Options and blocks ability of other modules (e.g Security Kit [3]) to add them, leaving it vulnerable to Clickjacking. Solution: Install the latest version: * If you use the Opigno learning path module for Drupal 8.x, upgrade to a version greater than 8.x-1.10 Opigno learning path 8.x-1.11 or later [4] The issue was fixed in public but needed a security advisory. Users of the module are encouraged to upgrade to at least 8.x-1.11 or a later version to gain protection against this weakness. Reported By: * Bryan Butler [5] Fixed By: * James Aparicio [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/opigno_learning_path [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/seckit [4] https://www.drupal.org/project/opigno_learning_path/releases/8.x-1.11 [5] https://www.drupal.org/user/3591325 [6] https://www.drupal.org/user/2547544 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450

1 0

Block Content Revision UI - Moderately critical - Access bypass - SA-CONTRIB-2021-017
by security-news＠drupal.org 16 Jun '21

16 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-017 Project: Block Content Revision UI [1] Date: 2021-June-16 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module provides a revision UI to Block Content entities. The module doesn't sufficiently respect access restrictions to certain entities when used in conjunction with specific modules. This vulnerability is mitigated by the fact that an attacker must have a role with any of the permissions provided by Block Content Revision UI, and another affected module must be enabled. Solution: Install the latest version: * If you use the Block Content Revision UI module for Drupal 8.x, upgrade to Block Content Revision UI 2.127.1 [3] Reported By: * Michael Strelan [4] Fixed By: * Michael Strelan [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Lee Rowlands [7] of the Drupal Security Team * Drew Webber [8] of the Drupal Security Team [1] https://www.drupal.org/project/block_content_revision_ui [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/block_content_revision_ui/releases/2.127.1 [4] https://www.drupal.org/user/314289 [5] https://www.drupal.org/user/314289 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/255969

1 0

Linky Revision UI - Moderately critical - Access bypass - SA-CONTRIB-2021-016
by security-news＠drupal.org 16 Jun '21

16 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-016 Project: Linky Revision UI [1] Date: 2021-June-16 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module provides a revision UI to Linky entities. The module doesn't sufficiently respect access restrictions to certain entities when used in conjunction with specific modules. This vulnerability is mitigated by the fact that an attacker must have a role with any of the permissions provided by Linky Revision UI, and another affected module must be enabled. Solution: Install the latest version: * If you use the Linky Revision UI module for Drupal 8.x, upgrade to Linky Revision UI 2.127.1 [3] Reported By: * Michael Strelan [4] Fixed By: * Michael Strelan [5] * Lee Rowlands [6] of the Drupal Security Team Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Drew Webber [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team [1] https://www.drupal.org/project/linky_revision_ui [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/linky_revision_ui/releases/2.127.1 [4] https://www.drupal.org/user/314289 [5] https://www.drupal.org/user/314289 [6] https://www.drupal.org/user/395439 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/user/395439

1 0

Chaos Tool Suite (ctools) - Moderately critical - Access bypass - SA-CONTRIB-2021-015
by security-news＠drupal.org 16 Jun '21

16 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-015 Project: Chaos Tool Suite (ctools) [1] Date: 2021-June-16 Security risk: *Moderately critical* 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: Chaos tool suite (ctools) module provides a number of APIs and extensions for Drupal, it's 8.x-3.x branch is a start from scratch to evaluate the features of ctools that didn't make it into Drupal Core 8.0.x and port them. The module doesn't sufficiently handle block access control on its EntityView plugin. This is a followup to more fully implement the fixes from SA-CONTRIB-2021-009 [3] This vulnerability is mitigated by the fact that successful exploitation requires special conditions in place such as custom blockAccess() method that differs from the default return value of 'AccessResult::allowed()' and extending from EntityView. Solution: Install the latest version: * If you use the CTools module for Drupal 8.x, upgrade to CTools 8.x-3.7 [4] Reported By: * Michael Vanetta [5] Fixed By: * Michael Vanetta [6] * Joël Pittet [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Drew Webber [9] of the Drupal Security Team [1] https://www.drupal.org/project/ctools [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-contrib-2021-009 [4] https://www.drupal.org/project/ctools/releases/8.x-3.7 [5] https://www.drupal.org/user/452914 [6] https://www.drupal.org/user/452914 [7] https://www.drupal.org/user/160302 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/255969

1 0

OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2021-014
by security-news＠drupal.org 02 Jun '21

02 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-014 Project: OpenID Connect / OAuth client [1] Date: 2021-June-02 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module allows users to authenticate against an Oauth 2.0 / OpenID Connect identity provider to login to your Drupal site. The module doesn't sufficiently protect against unauthorized local access, by way of using the 'password reset' facility, for users who are supposed to only be able to log in through the identity provider. This creates a scenario where after such a user is blocked from logging in through the identity provider but not explicitly blocked in Drupal, they are still able to log in by sending themselves a Drupal 'password reset' e-mail. Solution: Install the latest version: * If you use the openid_connect module for Drupal 8/9, upgrade to openid_connect 8.x-1.1 [3] * If you use the openid_connect module for Drupal 7, upgrade to openid_connect 7.x-1.0 [4] Reported By: * Jeffrey Bertoen [5] Fixed By: * João Ventura [6] * Philip Frilling [7] * Jeffrey Bertoen [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team [1] https://www.drupal.org/project/openid_connect [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/openid_connect/releases/8.x-1.1 [4] https://www.drupal.org/project/openid_connect/releases/7.x-1.0 [5] https://www.drupal.org/user/2733365 [6] https://www.drupal.org/user/122464 [7] https://www.drupal.org/user/169695 [8] https://www.drupal.org/user/2733365 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/255969

1 0

GraphQL - Moderately critical - Information Disclosure - SA-CONTRIB-2021-013
by security-news＠drupal.org 02 Jun '21

02 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-013 Project: GraphQL [1] Date: 2021-June-02 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information Disclosure Description: This module lets you craft and expose a GraphQL web service API. The module does not sufficiently protect arbitrary exception and error messages thereby exposing an information disclosure vulnerability. This vulnerability is mitigated by the fact that a GraphQL server must be enabled and a data producer be configured that throws exceptions with confidential error messages that must not be exposed over the GraphQL API. Solution: Install the latest version: * If you use the GraphQL module for Drupal 8.x, upgrade to GraphQL 8.x-4.1 [3] Reported By: * Alex Tkachev [4] Fixed By: * Klaus Purer [5] * Radoslav Terezka [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/graphql [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/graphql/releases/8.x-4.1 [4] https://www.drupal.org/user/390336 [5] https://www.drupal.org/user/262198 [6] https://www.drupal.org/user/741876 [7] https://www.drupal.org/user/36762

1 0

Frequently Asked Questions - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-012
by security-news＠drupal.org 02 Jun '21

02 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-012 Project: Frequently Asked Questions [1] Date: 2021-June-02 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: The Frequently Asked Questions (faq) module allows users, with appropriate permissions, to create question and answer pairs which they want displayed on the 'faq' page. The 'faq' page is automatically generated from the FAQ nodes configured. Basic Views layouts are also provided and can be customised via the Views UI (rather than via the module settings page). The module doesn't sufficiently sanitize editor input leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the "create faq content" permission. Solution: Install the latest version: * If you use the Frequently Asked Questions module for Drupal 7.x, upgrade to Frequently Asked Questions 7.x-1.3 [3] Reported By: * Mitch Portier [4] Fixed By: * Mitch Portier [5] * Mohammed Razem [6] * Vijay Mani [7] Provisional Member of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/faq [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/faq/releases/7.x-1.3 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/255384 [7] https://www.drupal.org/user/93488 [8] https://www.drupal.org/user/36762

1 0