- Security-news - lists.drupal.org

Group - Critical - Information Disclosure - SA-CONTRIB-2020-030
by security-news＠drupal.org 29 Jul '20

29 Jul '20

View online: https://www.drupal.org/sa-contrib-2020-030 Project: Group [1] Version: 8.x-1.x-dev Date: 2020-July-29 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Information Disclosure Description: This module enables you to hand out permissions on a smaller subset, section or community of your website. The module used to leverage the node grants system but turned it off in its recent 8.x-1.0 release in favor of a system that works for ALL entity types, not just nodes. By doing so, some regular node access checks turned from neutral into allowed because of the way the node grants system operates. This vulnerability is mitigated by the fact that an attacker must have the GroupNode plugin installed on their website and have no other hook_node_grants() implementations on their website aside from the one that was recently removed by Group. If you do not use the GroupNode plugin or still have hook_node_grants() implementing modules enabled, your site may not be affected. Solution: Install the latest version: * If you are using 8.x-1.0-rc5 you can keep using that version or upgrade to 8.x-1.1 [3] * If you are using 8.x-1.0 you should upgrade to 8.x-1.1 [4] Reported By: * Kristiaan Van den Eynde [5] Fixed By: * Kristiaan Van den Eynde [6] Coordinated By: * Greg Knaddison [7] Of the Drupal Security Team [1] https://www.drupal.org/project/group [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/group/releases/8.x-1.1 [4] https://www.drupal.org/project/group/releases/8.x-1.1 [5] https://www.drupal.org/user/1345130 [6] https://www.drupal.org/user/1345130 [7] https://www.drupal.org/u/greggles

1 0

Modal Form - Critical - Access bypass - SA-CONTRIB-2020-029
by security-news＠drupal.org 22 Jul '20

22 Jul '20

View online: https://www.drupal.org/sa-contrib-2020-029 Project: Modal Form [1] Version: 8.x-1.x-dev Date: 2020-July-22 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The Modal form module is a toolset for quick start of using forms in modal windows. Any form is available for view and submit when the modal_form module is installed. The only requirement is to know the form's fully-qualified class name. Solution: Upgrade to modal_form-8.x-1.2 [3]. Also see the Modal Form [4] project page. Reported By: * Dave Long [5] Fixed By: * Sergii Bondarenko [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/modal_form [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/modal_form/releases/8.x-1.2 [4] https://www.drupal.org/project/modal_form [5] https://www.drupal.org/user/246492 [6] https://www.drupal.org/user/2802285 [7] https://www.drupal.org/user/36762

1 0

Apigee Edge - Moderately critical - Access bypass - SA-CONTRIB-2020-028
by security-news＠drupal.org 22 Jul '20

22 Jul '20

View online: https://www.drupal.org/sa-contrib-2020-028 Project: Apigee Edge [1] Version: 8.x-1.x-dev Date: 2020-July-22 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: The Apigee Edge module allows connecting a Drupal site to Apigee Edge in order to build a developer portal. It contains an "Apigee Edge Teams" submodule that provides shared app functionality by allowing developers to be organized into teams. The "Apigee Edge Teams" submodule has an information disclosure vulnerability. The "Add team member" form displays an email autocomplete field which can expose the email addresses of other accounts in the system. This vulnerability is mitigated by the fact that to have access to the form, the site must have the Apigee Edge Teams submodule enabled, and the user must have a team role that has the "Manage team members" permission. (Note that team roles and permissions are not related to Drupal core roles and permissions). Solution: Install the latest version: * If you use the apigee_edge_teams submodule for Drupal 8.x, upgrade to Apigee Edge module 8.x-1.12 [3] Also see the Apigee Edge [4] project page. Reported By: * Arlina Espinoza Rhoton [5] Fixed By: * Arlina Espinoza Rhoton [6] * Chris Novak [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/apigee_edge [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/apigee_edge/releases/8.x-1.12 [4] https://www.drupal.org/project/apigee_edge [5] https://www.drupal.org/user/1055344 [6] https://www.drupal.org/user/1055344 [7] https://www.drupal.org/user/880416 [8] https://www.drupal.org/user/36762

1 0

Easy Breadcrumb - Moderately critical - Cross site scripting - SA-CONTRIB-2020-027
by security-news＠drupal.org 22 Jul '20

22 Jul '20

View online: https://www.drupal.org/sa-contrib-2020-027 Project: Easy Breadcrumb [1] Version: 8.x-1.x-dev Date: 2020-July-22 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module enables you to use the current URL (path alias) and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website. The module doesn't sufficiently sanitize editor input in certain circumstances leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability requires the user have 'administer Easy Breadcrumb settings permission'. Solution: Install the latest version: * If you use the Easy Breadcrumb module for Drupal 8, upgrade to Easy Breadcrumb 8.x-1.13 [3] Also see the Easy Breadcrumb [4] project page. Reported By: * Greg Boggs [5] Fixed By: * Greg Boggs [6] * Samuel Mortenson [7] of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/easy_breadcrumb [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/easy_breadcrumb/releases/8.x-1.13 [4] https://www.drupal.org/project/easy_breadcrumb [5] https://www.drupal.org/user/153069 [6] https://www.drupal.org/user/153069 [7] https://www.drupal.org/user/2582268 [8] https://www.drupal.org/user/36762

1 0

Renderkit - Less critical - Access bypass - SA-CONTRIB-2020-026
by security-news＠drupal.org 01 Jul '20

01 Jul '20

View online: https://www.drupal.org/sa-contrib-2020-026 Project: Renderkit [1] Version: 7.x-1.x-dev Date: 2020-July-01 Security risk: *Less critical* 9∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: The renderkit module contains components which can transform the display of field items sent to it. Some of these components do not respect the '#access' property on the field render element, and thus can make rendered field values visible to visitors who would otherwise not be allowed to see those field values. This only occurs if all of the following conditions are true: * Your site has a field where viewing access is restricted on field level, e.g. using the "Field permissions" module. * The access-restricted field is displayed using the "Field with formatter" entity display from renderkit, in combination with one of the affected field display processor components. Solution: If a site is affected there are 2 steps to fix this issue on a site: .... Step 1: Install the latest version of renderkit: * If you use the renderkit module for Drupal 7.x, upgrade to Renderkit 7.x-1.14 [3]. .... Step 2: Review your custom modules. Look for classes that implement FieldDisplayProcessorInterface. Consider to extend the FieldDisplayProcessorBase class instead of implementing the interface. Also see the Renderkit [4] project page. Reported By: * Andreas Hennings [5] Fixed By: * Andreas Hennings [6] * mibfire [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/renderkit [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/renderkit/releases/7.x-1.14 [4] https://www.drupal.org/project/renderkit [5] https://www.drupal.org/user/459338 [6] https://www.drupal.org/user/459338 [7] https://www.drupal.org/user/155136 [8] https://www.drupal.org/user/36762

1 0

Extending Drupal 7's End-of-Life - PSA-2020-06-24
by security-news＠drupal.org 24 Jun '20

24 Jun '20

View online: https://www.drupal.org/psa-2020-06-24 Date: 2020-June-24 Description: Previously, Drupal 7's end-of-life was scheduled for November 2021. Given the impact of COVID-19 on budgets and businesses, we will be extending the end of life until *November 28, 2022*. The Drupal Security Team will continue to follow the Security Team processes [1] for Drupal 7 core and contributed projects. However, this means extra work from the Drupal community at large and the security team in particular to review security reports, create patches, and release security advisories for Drupal 7. This community effort will give site owners more time while budgets recover, but the organizations that sponsor security team members and the individual security team members who volunteer their time could use your support. If you can, please donate to support the end-of-life extension [2]. *Drupal 8 will still be end-of-life on November 2, 2021*, due to Symfony 3's end of life [3]. However, since the upgrade path from Drupal 8 to Drupal 9 is much easier, we don't anticipate the same impact on end-users. .... What does this mean for my Drupal 7 site? You can continue to run the site and get security updates via the normal channels and processes. This will give you an extra year to work on converting your site to Drupal 9. .. Do I need to upgrade to Drupal 8 before I upgrade to Drupal 9? Migrating directly from Drupal 7 to Drupal 9 is supported with the core Migrate module. Read more on preparing a Drupal 7 site for Drupal 9 [4]. .... How can I help? *Consider donating [5] to support this effort.* If you are a representative of a large end-user of Drupal, we'd love you to join the Drupal Association and the security team as a partner. You can also consider getting more involved in fixing issues in the issue queue [6] or joining the Security Team [7] as a way to support the effort. .... What about Drupal 7 Vendor Extended Support? The extended support will now run from November 2022 until November 2025. You can read more about the Druapl 7 Vendor Extended Support program [8]. .... What about contributed projects? The Security Team will continue to follow the Security Team processes [9] for contributed projects. Contributed project maintainers are asked to consider supporting existing Drupal 7 releases if they are able. [1] https://www.drupal.org/drupal-security-team/security-team-procedures [2] http://drupal.org/security-team/donate [3] https://symfony.com/releases/3.4 [4] https://www.drupal.org/docs/understanding-drupal/drupal-9-release-date-and-… [5] http://drupal.org/security-team/donate [6] https://www.drupal.org/project/issues/drupal?text=&status=Open&priorities=A… [7] https://www.drupal.org/drupal-security-team/how-to-join-the-drupal-security… [8] https://www.drupal.org/drupal-security-team/information-for-organizations-i… [9] https://www.drupal.org/drupal-security-team/security-team-procedures

1 0

Internationalization - Moderately critical - Cross site scripting - SA-CONTRIB-2020-025
by security-news＠drupal.org 17 Jun '20

17 Jun '20

View online: https://www.drupal.org/sa-contrib-2020-025 Project: Internationalization [1] Version: 7.x-1.x-dev Date: 2020-June-17 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: The Internationalization (i18n) [3] module is a collection of modules to extend Drupal core multilingual capabilities and allows to build real life multilingual sites. A value in the term translation module is displayed without being escaped leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit terms in " on a taxonomy vocabulary with i18n term translation enabled and the victim uses the i18n term translation page. Solution: Install the latest version: * If you use the Internationalization (i18n) [4] module for Drupal 7.x, upgrade to i18n 7.x-1.27 [5] Also see the Internationalization [6] project page. Reported By: * Guillaume MEMEINT [7] Fixed By: * Guillaume MEMEINT [8] * Peter Philipp [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/i18n [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/i18n [4] https://www.drupal.org/project/i18n [5] https://www.drupal.org/node/3152334 [6] https://www.drupal.org/project/i18n [7] https://www.drupal.org/user/2760067 [8] https://www.drupal.org/user/2760067 [9] https://www.drupal.org/user/762870 [10] https://www.drupal.org/user/36762

1 0

Drupal core - Less critical - Access bypass - SA-CORE-2020-006
by security-news＠drupal.org 17 Jun '20

17 Jun '20

View online: https://www.drupal.org/sa-core-2020-006 Project: Drupal core [1] Date: 2020-June-17 Security risk: *Less critical* 8∕25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass CVE IDs: CVE-2020-13665 Description: JSON:API PATCH requests may bypass validation for certain fields. By default, JSON:API works in a read-only mode which makes it impossible to exploit the vulnerability. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. Solution: Install the latest version: * If you are using Drupal 8.8.x, upgrade to Drupal 8.8.8 [3]. * If you are using Drupal 8.9.x, upgrade to Drupal 8.9.1 [4]. * If you are using Drupal 9.0.x, upgrade to Drupal 9.0.1 [5]. Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.8. Reported By: * Sergii Bondarenko [6] Fixed By: * Sergii Bondarenko [7] * Wim Leers [8] * Jess [9] of the Drupal Security Team * Lee Rowlands [10] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/8.8.8 [4] https://www.drupal.org/project/drupal/releases/8.9.1 [5] https://www.drupal.org/project/drupal/releases/9.0.1 [6] https://www.drupal.org/user/2802285 [7] https://www.drupal.org/user/2802285 [8] https://www.drupal.org/user/99777 [9] https://www.drupal.org/user/65776 [10] https://www.drupal.org/user/395439

1 0

Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-005
by security-news＠drupal.org 17 Jun '20

17 Jun '20

View online: https://www.drupal.org/sa-core-2020-005 Project: Drupal core [1] Date: 2020-June-17 Security risk: *Critical* 17∕25 AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Arbitrary PHP code execution CVE IDs: CVE-2020-13664 Description: Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. Solution: Install the latest version: * If you are using Drupal 8.8.x, upgrade to Drupal 8.8.8 [3]. * If you are using Drupal 8.9.x, upgrade to Drupal 8.9.1 [4]. * If you are using Drupal 9.0.x, upgrade to Drupal 9.0.1 [5]. Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.8. Reported By: * Lorenzo G [6] * Sam Thomas [7] Fixed By: * Jess [8] of the Drupal Security Team * Samuel Mortenson [9] of the Drupal Security Team * Peter Wolanin [10] of the Drupal Security Team * Lorenzo G [11] * Lee Rowlands [12] of the Drupal Security Team * Greg Knaddison [13] of the Drupal Security Team * Cash Williams [14] of the Drupal Security Team * Heine [15] of the Drupal Security Team * Drew Webber [16] of the Drupal Security Team * Alex Pott [17] of the Drupal Security Team * Gábor Hojtsy [18] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/8.8.8 [4] https://www.drupal.org/project/drupal/releases/8.9.1 [5] https://www.drupal.org/project/drupal/releases/9.0.1 [6] https://www.drupal.org/user/3644903 [7] https://www.drupal.org/user/3603418 [8] https://www.drupal.org/user/65776 [9] https://www.drupal.org/user/2582268 [10] https://www.drupal.org/user/49851 [11] https://www.drupal.org/user/3644903 [12] https://www.drupal.org/user/395439 [13] https://www.drupal.org/user/36762 [14] https://www.drupal.org/user/421070 [15] https://www.drupal.org/user/17943 [16] https://www.drupal.org/user/255969 [17] https://www.drupal.org/user/157725 [18] https://www.drupal.org/user/4166

1 0

Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004
by security-news＠drupal.org 17 Jun '20

17 Jun '20

View online: https://www.drupal.org/sa-core-2020-004 Project: Drupal core [1] Date: 2020-June-17 Security risk: *Critical* 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13663 Description: The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities. Solution: * If you are using Drupal 7.x, upgrade to Drupal 7.72 [3]. * If you are using Drupal 8.8.x, upgrade to Drupal 8.8.8 [4]. * If you are using Drupal 8.9.x, upgrade to Drupal 8.9.1 [5]. * If you are using Drupal 9.0.x, upgrade to Drupal 9.0.1 [6]. Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.8. Reported By: * Samuel Mortenson [7] of the Drupal Security Team * Dor Tumarkin [8] Fixed By: * Greg Knaddison [9] of the Drupal Security Team * Samuel Mortenson [10] of the Drupal Security Team * Jess [11] of the Drupal Security Team * Lee Rowlands [12] of the Drupal Security Team * Angie Byron [13] of the Drupal Security Team * Peter Wolanin [14] of the Drupal Security Team * Daniel Wehner [15] * Dor Tumarkin [16] * Drew Webber [17] of the Drupal Security Team * Alex Pott [18] of the Drupal Security Team * David Snopek [19] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/7.72 [4] https://www.drupal.org/project/drupal/releases/8.8.8 [5] https://www.drupal.org/project/drupal/releases/8.9.1 [6] https://www.drupal.org/project/drupal/releases/9.0.1 [7] https://www.drupal.org/user/2582268 [8] https://www.drupal.org/user/3648639 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/2582268 [11] https://www.drupal.org/user/65776 [12] https://www.drupal.org/user/395439 [13] https://www.drupal.org/user/24967 [14] https://www.drupal.org/user/49851 [15] https://www.drupal.org/user/99340 [16] https://www.drupal.org/user/3648639 [17] https://www.drupal.org/user/255969 [18] https://www.drupal.org/user/157725 [19] https://www.drupal.org/user/266527

1 0