View online: https://www.drupal.org/psa-2019-05-07
Date: 2019-May-07
Vulnerability: Drupal 7 and 8 release on May 8th, 2019 -
DRUPAL-PSA-2019-05-07
Description:
The Drupal Security Team will be coordinating a security release for Drupal 7
and 8 this week on Wednesday, May 8th, 2019.
*We are issuing this PSA in advance because according to the regular security
release window schedule [1], May 8th would not typically be a core security
window.*
*This release is rated as moderately critical. *
The Drupal 7 and 8 core release will be made between 16:00 – 21:00 UTC
(noon – 5:00pm Eastern).
May 8th also remains a normal security release window for contributed
projects.
[1] https://www.drupal.org/node/1173280
View online: https://www.drupal.org/sa-contrib-2019-043
Project: Services [1]
Version: 7.x-3.x-dev
Date: 2019-April-03
Security risk: *Less critical* 9∕25
AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass
Description:
This module provides a standardized solution for building API's so that
external clients can communicate with Drupal.
The Services module has an access bypass vulnerability in its "attach_file"
resource that allows users who have access to create or update nodes that
include file fields to arbitrarily reference files they do not have access
to, which can expose private files.
This vulnerability is mitigated by the fact that an attacker must have a role
with permission to create or edit a node.
Solution:
Install the latest version:
* If you use the Services module for Drupal 7.x, upgrade to Services
7.x-3.24 [3]
Also see the Services [4] project page.
Reported By:
* Samuel Mortenson [5] of the Drupal Security Team
Fixed By:
* Tyler Frankenstein [6]
Coordinated By:
* Samuel Mortenson [7] of the Drupal Security Team
* Greg Knaddison [8] of the Drupal Security Team
[1] https://www.drupal.org/project/services
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/services/releases/7.x-3.24
[4] https://www.drupal.org/project/services
[5] https://www.drupal.org/user/2582268
[6] https://www.drupal.org/user/150680
[7] https://www.drupal.org/user/2582268
[8] https://www.drupal.org/user/36762
View online: https://www.drupal.org/sa-contrib-2019-042
Project: Module Filter [1]
Version: 7.x-2.x-dev
Date: 2019-March-27
Security risk: *Moderately critical* 12∕25
AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross site scripting
Description:
This module enables you to filter the list of modules on the admin modules
page, and organizes packages into vertical tabs.
The module doesn't sufficiently escape HTML under the scenario leading to a
Cross Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that the attacker must have
access to input filtered html that will be included on the modules
administration page e.g. in a block (this configuration is not common).
Further, the Module Filter vertical tabs setting must be enabled.
Solution:
Install the latest version:
* If you use the Module Filter module for Drupal 7.x, upgrade to Module
Filter 7.x-2.2 [3]
Also see the Module Filter [4] project page.
Reported By:
* Yonatan Offek [5]
Fixed By:
* greenSkin [6]
Coordinated By:
* Greg Knaddison [7] of the Drupal Security Team
[1] https://www.drupal.org/project/module_filter
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/module_filter/releases/7.x-2.2
[4] https://www.drupal.org/project/module_filter
[5] https://www.drupal.org/user/194009
[6] https://www.drupal.org/user/173855
[7] https://www.drupal.org/user/36762