Security-news

security-news@drupal.org

1 participants
1782 discussions

Opigno Learning path - Moderately critical - Access bypass - SA-CONTRIB-2019-047
by security-news＠drupal.org 15 May '19

15 May '19

View online: https://www.drupal.org/sa-contrib-2019-047 Project: Opigno Learning path [1] Date: 2019-May-15 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: In certain configuration cases, when a learning path is configured as semi-private, anonymous users are allowed to join a learning path when they should not. Solution: Install the latest version: * If you use the opigno learning path module for Drupal 8.x, upgrade to opigno_learning_path 8.x-1.4 [3] * If using the opigno lms distribution it is recommended to update the whole distribution to the latest version Opigno lms 8.x-1.5 [4] Also see the Opigno Learning path [5] project page. Reported By: * Nathaniel Catchpole [6] of the Drupal Security Team Fixed By: * James Aparicio [7] * Nathaniel Catchpole [8] of the Drupal Security Team Coordinated By: * Nathaniel Catchpole [9] of the Drupal Security Team [1] https://www.drupal.org/project/opigno_learning_path [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/opigno_learning_path/releases/8.x-1.4 [4] https://www.drupal.org/project/opigno_lms/releases/8.x-1.5 [5] https://www.drupal.org/project/opigno_learning_path [6] https://www.drupal.org/user/35733 [7] https://www.drupal.org/user/2547544 [8] https://www.drupal.org/user/35733 [9] https://www.drupal.org/user/35733

1 0

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2019-007
by security-news＠drupal.org 08 May '19

08 May '19

View online: https://www.drupal.org/sa-core-2019-007 Project: Drupal core [1] Date: 2019-May-08 Security risk: *Moderately critical* 14∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Third-party libraries Description: This security release fixes third-party dependencies included in or required by Drupal core. As described in TYPO3-PSA-2019-007: By-passing protection of Phar Stream Wrapper Interceptor [3]: >In order to intercept file invocations like file_exists or stat on >compromised Phar archives the base name has to be determined and checked >before allowing to be handled by PHP Phar stream handling. [...] > >The current implementation is vulnerable to path traversal leading to >scenarios where the Phar archive to be assessed is not the actual >(compromised) file. > Solution: Install the latest version: * If you are using Drupal 8.7, update to Drupal 8.7.1 [4] * If you are using Drupal 8.6 or earlier, update to Drupal 8.6.16 [5]. * If you are using Drupal 7, update to Drupal 7.67 [6]. Versions of Drupal 8 prior to 8.6.x are end-of-life and do not receive security coverage. Also see the Drupal core [7] project page. Reported By: * Daniel Le Gall [8] Fixed By: * Jess [9] of the Drupal Security Team * Michael Hess [10] of the Drupal Security Team * Oliver Hader [11] * David Snopek [12] of the Drupal Security Team * Alex Pott [13] of the Drupal Security Team * Daniel Le Gall [14] * Tim Plunkett [15] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://typo3.org/security/advisory/typo3-psa-2019-007/ [4] https://www.drupal.org/project/drupal/releases/8.7.1 [5] https://www.drupal.org/project/drupal/releases/8.6.16 [6] https://www.drupal.org/project/drupal/releases/7.67 [7] https://www.drupal.org/project/drupal [8] https://www.drupal.org/user/3606561 [9] https://www.drupal.org/user/65776 [10] https://www.drupal.org/user/102818 [11] https://www.drupal.org/user/3602633 [12] https://www.drupal.org/user/266527 [13] https://www.drupal.org/user/157725 [14] https://www.drupal.org/user/3606561 [15] https://www.drupal.org/user/241634

1 0

Drupal 7 and 8 release on May 8th, 2019 - DRUPAL-PSA-2019-05-07 - PSA-2019-2019-05-07
by security-news＠drupal.org 07 May '19

07 May '19

View online: https://www.drupal.org/psa-2019-05-07 Date: 2019-May-07 Vulnerability: Drupal 7 and 8 release on May 8th, 2019 - DRUPAL-PSA-2019-05-07 Description: The Drupal Security Team will be coordinating a security release for Drupal 7 and 8 this week on Wednesday, May 8th, 2019. *We are issuing this PSA in advance because according to the regular security release window schedule [1], May 8th would not typically be a core security window.* *This release is rated as moderately critical. * The Drupal 7 and 8 core release will be made between 16:00 – 21:00 UTC (noon – 5:00pm Eastern). May 8th also remains a normal security release window for contributed projects. [1] https://www.drupal.org/node/1173280

1 0

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-006
by security-news＠drupal.org 17 Apr '19

17 Apr '19

View online: https://www.drupal.org/sa-core-2019-006 Project: Drupal core [1] Date: 2019-April-17 Security risk: *Moderately critical* 10∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: The jQuery project released version 3.4.0, and as part of that, disclosed a security vulnerability that affects all prior versions. As described in their release notes [3]: >jQuery 3.4.0 includes a fix for some unintended behavior when using >jQuery.extend(true, {}, ...). If an unsanitized source object contained an >enumerable __proto__ property, it could extend the native Object.prototype. >This fix is included in jQuery 3.4.0, but patch diffs exist to patch >previous jQuery versions. > It's possible that this vulnerability is exploitable with some Drupal modules. As a precaution, this Drupal security release backports the fix to jQuery.extend(), without making any other changes to the jQuery version that is included in Drupal core (3.2.1 for Drupal 8 and 1.4.4 for Drupal 7) or running on the site via some other module such as jQuery Update [4]. Solution: Install the latest version: * If you are using Drupal 8.6, update to Drupal 8.6.15 [5]. * If you are using Drupal 8.5 or earlier, update to Drupal 8.5.15 [6]. * If you are using Drupal 7, update to Drupal 7.66 [7]. Versions of Drupal 8 prior to 8.5.x are end-of-life and do not receive security coverage. Also see the Drupal core [8] project page. .... Additional information All advisories released today: * SA-CORE-2019-005 [9] * SA-CORE-2019-006 [10] Updating to the latest Drupal core release will apply the fixes for all the above advisories. Reported By: * dtv_rb [11] * Jess [12] of the Drupal Security Team Fixed By: * Alex Bronstein [13] of the Drupal Security Team * Lee Rowlands [14] of the Drupal Security Team * Jess [15] of the Drupal Security Team * Lauri Eskola [16] * Greg Knaddison [17] of the Drupal Security Team * Neil Drumm [18] of the Drupal Security Team * Samuel Mortenson [19] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ [4] https://www.drupal.org/project/jquery_update [5] https://www.drupal.org/project/drupal/releases/8.6.15 [6] https://www.drupal.org/project/drupal/releases/8.5.15 [7] https://www.drupal.org/project/drupal/releases/7.66 [8] https://www.drupal.org/project/drupal [9] https://www.drupal.org/sa-core-2019-005 [10] https://www.drupal.org/sa-core-2019-006 [11] https://www.drupal.org/user/3528196 [12] https://www.drupal.org/user/65776 [13] https://www.drupal.org/user/78040 [14] https://www.drupal.org/user/395439 [15] https://www.drupal.org/user/65776 [16] https://www.drupal.org/user/1078742 [17] https://www.drupal.org/user/36762 [18] https://www.drupal.org/user/3064 [19] https://www.drupal.org/user/2582268

1 0

TableField - Critical - Remote Code Execution - SA-CONTRIB-2019-045
by security-news＠drupal.org 17 Apr '19

17 Apr '19

View online: https://www.drupal.org/sa-contrib-2019-045 Project: TableField [1] Date: 2019-April-17 Security risk: *Critical* 16∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Remote Code Execution Description: This module allows you to attach tabular data to an entity. The module doesn't sufficiently determine that the data being unserialized is the contents of a tablefield when users request a CSV export, which could lead to Remote Code Execution via Object Injection. This vulnerability is mitigated by the fact that an attacker must have a role with the permission 'export tablefield', and be able to insert a payload into an entity's field. Solution: Install the latest version: * If you use the Tablefield module 7.x-3.x branch for Drupal 7.x, upgrade to tablefield 7.x-3.4 [3] Reported By: * Drew Webber [4] Provisional Security Team Member Fixed By: * Drew Webber [5] Provisional Security Team Member * Martin Postma [6] * Jen Lampton [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/tablefield [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tablefield/releases/7.x-3.4 [4] https://www.drupal.org/user/255969 [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/210402 [7] https://www.drupal.org/user/85586 [8] https://www.drupal.org/user/36762

1 0

Stage File Proxy - Less critical - Denial of Service - SA-CONTRIB-2019-044
by security-news＠drupal.org 17 Apr '19

17 Apr '19

View online: https://www.drupal.org/sa-contrib-2019-044 Project: Stage File Proxy [1] Version: 8.x-1.x-dev7.x-1.x-dev Date: 2019-April-17 Security risk: *Less critical* 9∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] Vulnerability: Denial of Service Description: Stage File Proxy is a general solution for getting production files on a development server on demand. The module doesn't sufficiently validate requested urls, allowing an attacker to send repeated requests for files that do not exist which could exhaust resources on the server where Stage File Proxy is installed. This vulnerability is mitigated by the fact that an attacker must make repeated requests. The vulnerability only exists on environments where Stage File Proxy is installed (it generally is not installed on production). It only affects sites where the "Hot Link" option is disabled (disabled is the default configuration). Solution: Install the latest version: * If you use the Stage File Proxy module for Drupal 7.x, upgrade to Stage File Proxy 7.x-1.9 [3] Also see the Stage File Proxy [4] project page. Reported By: * remydenton [5] * Axel Rutz [6] * Drew Webber [7] Fixed By: * remydenton [8] * Axel Rutz [9] * Drew Webber [10] Coordinated By: * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/stage_file_proxy [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/stage_file_proxy/releases/7.x-1.9 [4] https://www.drupal.org/project/stage_file_proxy [5] https://www.drupal.org/user/969184 [6] https://www.drupal.org/user/229048 [7] https://www.drupal.org/user/255969 [8] https://www.drupal.org/user/969184 [9] https://www.drupal.org/user/229048 [10] https://www.drupal.org/user/255969 [11] https://www.drupal.org/u/greggles

1 0

Services - Less critical - Access bypass - SA-CONTRIB-2019-043
by security-news＠drupal.org 03 Apr '19

03 Apr '19

View online: https://www.drupal.org/sa-contrib-2019-043 Project: Services [1] Version: 7.x-3.x-dev Date: 2019-April-03 Security risk: *Less critical* 9∕25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module provides a standardized solution for building API's so that external clients can communicate with Drupal. The Services module has an access bypass vulnerability in its "attach_file" resource that allows users who have access to create or update nodes that include file fields to arbitrarily reference files they do not have access to, which can expose private files. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit a node. Solution: Install the latest version: * If you use the Services module for Drupal 7.x, upgrade to Services 7.x-3.24 [3] Also see the Services [4] project page. Reported By: * Samuel Mortenson [5] of the Drupal Security Team Fixed By: * Tyler Frankenstein [6] Coordinated By: * Samuel Mortenson [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/services [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/services/releases/7.x-3.24 [4] https://www.drupal.org/project/services [5] https://www.drupal.org/user/2582268 [6] https://www.drupal.org/user/150680 [7] https://www.drupal.org/user/2582268 [8] https://www.drupal.org/user/36762

1 0

Module Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2019-042
by security-news＠drupal.org 27 Mar '19

27 Mar '19

View online: https://www.drupal.org/sa-contrib-2019-042 Project: Module Filter [1] Version: 7.x-2.x-dev Date: 2019-March-27 Security risk: *Moderately critical* 12∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross site scripting Description: This module enables you to filter the list of modules on the admin modules page, and organizes packages into vertical tabs. The module doesn't sufficiently escape HTML under the scenario leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that the attacker must have access to input filtered html that will be included on the modules administration page e.g. in a block (this configuration is not common). Further, the Module Filter vertical tabs setting must be enabled. Solution: Install the latest version: * If you use the Module Filter module for Drupal 7.x, upgrade to Module Filter 7.x-2.2 [3] Also see the Module Filter [4] project page. Reported By: * Yonatan Offek [5] Fixed By: * greenSkin [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/module_filter [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/module_filter/releases/7.x-2.2 [4] https://www.drupal.org/project/module_filter [5] https://www.drupal.org/user/194009 [6] https://www.drupal.org/user/173855 [7] https://www.drupal.org/user/36762

1 0

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004
by security-news＠drupal.org 20 Mar '19

20 Mar '19

View online: https://www.drupal.org/sa-core-2019-004 Project: Drupal core [1] Date: 2019-March-20 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description: Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability. Solution: * If you are using Drupal 8.6, update to Drupal 8.6.13 [3]. * If you are using Drupal 8.5 or earlier, update to Drupal 8.5.14 [4]. * If you are using Drupal 7, update to Drupal 7.65 [5]. Versions of Drupal 8 prior to 8.5.x are end-of-life and do not receive security coverage. Reported By: * Zero Day Initiative [6] Fixed By: * Alex Pott [7] of the Drupal Security Team * Lee Rowlands [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team * Neil Drumm [10] of the Drupal Security Team * Michael Hess [11] of the Drupal Security Team * David Rothstein [12] of the Drupal Security Team * Peter Wolanin [13] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/8.6.13 [4] https://www.drupal.org/project/drupal/releases/8.5.14 [5] https://www.drupal.org/project/drupal/releases/7.65 [6] https://www.drupal.org/user/3594938 [7] https://www.drupal.org/user/157725 [8] https://www.drupal.org/user/395439 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/3064 [11] https://www.drupal.org/user/102818 [12] https://www.drupal.org/user/124982 [13] https://www.drupal.org/user/49851

1 0

20 Mar '19

View online: https://www.drupal.org/sa-contrib-2019-040 Project: Back To Top [1] Date: 2019-March-20 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables you to add a button that hovers in the bottom of your screen and allows users to smoothly scroll up the page using jQuery. The module doesn't sufficiently sanitize the code that gets printed on pages leading to a Cross Site Scripting (XSS) issue. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access backtotop settings". Solution: Install the latest version: * If you use the Back To Top module for Drupal 7.x, upgrade to Back To Top 7.x-1.6 [3] Reported By: * Balazs Janos Tatar [4] Fixed By: * Mattias Axelsson [5] * Balazs Janos Tatar [6] Coordinated By: * Balazs Janos Tatar [7] [1] https://www.drupal.org/project/back_to_top [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/back_to_top/releases/7.x-1.6 [4] https://www.drupal.org/user/649590 [5] https://www.drupal.org/user/765764 [6] https://www.drupal.org/user/649590 [7] https://www.drupal.org/user/649590

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news