- Security-news - lists.drupal.org

Open ReadSpeaker - Moderately critical - Cross site scripting - SA-CONTRIB-2020-024
by security-news＠drupal.org 10 Jun '20

10 Jun '20

View online: https://www.drupal.org/sa-contrib-2020-024 Project: Open ReadSpeaker [1] Version: 8.x-1.x-dev Date: 2020-June-10 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module enables you to add a configured ReadSpeaker button for text-to-speech for your site visitors. The module doesn't sufficiently sanitize block configuration causing a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution: Install the latest version: * If you use the Open ReadSpeaker module for Drupal 8.x, upgrade to Open ReadSpeaker 8.x-1.5 [3] Also see the Open ReadSpeaker [4] project page. Reported By: * Ide Braakman [5] Fixed By: * Sven Schüring [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/open_readspeaker [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/open_readspeaker/releases/8.x-1.5 [4] https://www.drupal.org/project/open_readspeaker [5] https://www.drupal.org/user/1879760 [6] https://www.drupal.org/user/1515828 [7] https://www.drupal.org/user/36762

1 0

YubiKey - Less critical - Access bypass - SA-CONTRIB-2020-023
by security-news＠drupal.org 10 Jun '20

10 Jun '20

View online: https://www.drupal.org/sa-contrib-2020-023 Project: YubiKey [1] Version: 7.x-2.x-dev Date: 2020-June-10 Security risk: *Less critical* 9∕25 AC:Complex/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables you to use a Yubikey device to protect your Drupal user account. YubiKey is a secure method for logging into many websites using a cryptographically secure USB token. The module doesn't sufficiently implement login flood control when the module is configured for YubiKey OTP only. This allows an attacker to attempt many YubiKey OTP codes. However, a brute force attack on this code is not practical in most situations given the length and randomness of the OTP codes. Solution: Install the latest version: * If you use the Yubikey module for Drupal 7.x, upgrade to Yubikey 7.x-2.3 [3] Also see the YubiKey [4] project page. Reported By: * majorrobot [5] Fixed By: * Todd Johnson [6] * majorrobot [7] * Kurucz István [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/yubikey [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/yubikey/releases/7.x-2.3 [4] https://www.drupal.org/project/yubikey [5] https://www.drupal.org/user/168019 [6] https://www.drupal.org/user/263058 [7] https://www.drupal.org/user/168019 [8] https://www.drupal.org/user/58654 [9] https://www.drupal.org/user/36762

1 0

Services - Moderately critical - Access bypass - SA-CONTRIB-2020-022
by security-news＠drupal.org 03 Jun '20

03 Jun '20

View online: https://www.drupal.org/sa-contrib-2020-022 Project: Services [1] Version: 7.x-3.x-dev Date: 2020-June-03 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module provides a standardized solution for building API's so that external clients can communicate with Drupal. The module's taxonomy term index resource doesn't take into consideration certain access control tags provided (but unused) by core, that certain contrib modules depend on. This vulnerability is mitigated by the fact your site must have the taxonomy term index resource enabled, your site must have a contributed module enabled which utilizes taxonomy term access control, and an attacker must know your api endpoint's path. Solution: Install the latest version: * If you use the Services module for Drupal 7.x, upgrade to Services 7.x-3.26 [3] Also see the Services [4] project page. Reported By: * Vadym Abramchuk [5] Fixed By: * Vadym Abramchuk [6] * Tyler Frankenstein [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/services [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3144924 [4] https://www.drupal.org/project/services [5] https://www.drupal.org/user/3216035 [6] https://www.drupal.org/user/3216035 [7] https://www.drupal.org/user/150680 [8] https://www.drupal.org/user/36762

1 0

Password Reset Landing Page (PRLP) - Highly critical - Access bypass - SA-CONTRIB-2020-021
by security-news＠drupal.org 27 May '20

27 May '20

View online: https://www.drupal.org/sa-contrib-2020-021 Project: Password Reset Landing Page (PRLP) [1] Date: 2020-May-27 Security risk: *Highly critical* 20∕25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables you to force a password update when using password reset link. The module doesn't sufficiently validate the login URL allowing a malicious user to use a specially crafted URL to log in as another user. Solution: Install the latest version: * If you use the PRLP module for Drupal 8.x, upgrade to PRLP 8.x-1.5 [3] Also see the Password Reset Landing Page (PRLP) [4] project page. Reported By: * Kyle Einecker [5] * Seth Hill [6] Fixed By: * Joseph Purcell [7] * Jitesh Doshi [8] * Christian Crawford [9] * Kyle Einecker [10] Coordinated By: * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/prlp [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/prlp/releases/8.x-1.5 [4] https://www.drupal.org/project/prlp [5] https://www.drupal.org/user/2824963 [6] https://www.drupal.org/user/676480 [7] https://www.drupal.org/user/2944035 [8] https://www.drupal.org/user/1799550 [9] https://www.drupal.org/user/2888131 [10] https://www.drupal.org/user/2824963 [11] https://www.drupal.org/user/36762

1 0

Drupal Commerce - Moderately critical - Access bypass - SA-CONTRIB-2020-020
by security-news＠drupal.org 27 May '20

27 May '20

View online: https://www.drupal.org/sa-contrib-2020-020 Project: Drupal Commerce [1] Date: 2020-May-27 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: Drupal Commerce is used to build eCommerce websites and applications. It's possible to configure commerce to permit orders by anonymous users. In this configuration, customers who do not choose to create an account upon checkout completion remain anonymous, and the resulting orders are never assigned an owner. When anonymous users are granted the "View own orders" permission, they are able to see any such anonymous order via direct navigation to its view page. The module does not include extra access control necessary to ensure anonymous users are only able to view their own previously placed orders. This vulnerability is mitigated by the fact that a site must be configured to permit anonymous checkout and an attacker must be an anonymous user with the permission "View own orders". Solution: Install the latest version: * If you use Commerce for Drupal 8.x upgrade to Commerce 2.18 [3] Also see the Drupal Commerce [4] project page. Reported By: * Joe Kersey [5] * Honza Pobořil [6] Fixed By: * Alex Pott [7] of the Drupal Security Team * Matt Glaman [8] * Joe Kersey [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce/releases/8.x-2.18 [4] https://www.drupal.org/project/commerce [5] https://www.drupal.org/user/2229066 [6] https://www.drupal.org/user/123612 [7] https://www.drupal.org/user/157725 [8] https://www.drupal.org/user/2416470 [9] https://www.drupal.org/user/2229066 [10] https://www.drupal.org/user/36762

1 0

Drupal core - Moderately critical - Open Redirect - SA-CORE-2020-003
by security-news＠drupal.org 20 May '20

20 May '20

View online: https://www.drupal.org/sa-core-2020-003 Project: Drupal core [1] Date: 2020-May-20 Security risk: *Moderately critical* 10∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Open Redirect Description: Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function. Other versions of Drupal core are not vulnerable. Solution: Install the latest version: * If you use Drupal 7.x upgrade to Drupal 7.70 [3] Reported By: * vortfu [4] Fixed By: * Drew Webber [5] of the Drupal Security Team * Fabian Franz [6] * David Snopek [7] of the Drupal Security Team * vortfu [8] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/7.70 [4] https://www.drupal.org/user/3638636 [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/693738 [7] https://www.drupal.org/user/266527 [8] https://www.drupal.org/user/3638636

1 0

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002
by security-news＠drupal.org 20 May '20

20 May '20

View online: https://www.drupal.org/sa-core-2020-002 Project: Drupal core [1] Date: 2020-May-20 Security risk: *Moderately critical* 10∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog [3], both are >[...] security issues in jQuery’s DOM manipulation methods, as in .html(), >.append(), and the others. Security advisories for both of these issues have >been published on GitHub. > Those advisories are: * CVE-2020-11022 [4] * CVE-2020-11023 [5] These vulnerabilities may be exploitable on some Drupal sites. This Drupal security release backports the fixes to the relevant jQuery functions, without making any other changes to the jQuery version that is included in Drupal core or running on the site via some other module such as jQuery Update [6]. It is not necessary to update jquery_update on Drupal 7 sites that have the module installed. Backwards-compatibility code has also been added to minimize regressions to Drupal sites that might rely on jQuery's prior behavior. With jQuery 3.5, incorrect self-closing HTML tags in JavaScript for elements where end tags are normally required will encounter a change in what jQuery returns or inserts [7]. To minimize that disruption in 8.8.x and earlier, this security release retains jQuery's prior behavior for most safe tags. There may still be regressions for edge cases, including invalidly self-closed custom elements [8] on Internet Explorer. (Note: the backwards compatibility layer will not be included in the upcoming Drupal 8.9 and 9.0 releases, so Drupal 8 and 9 modules, themes, and sites should correct tags in JavaScript to properly use closing tags.) If you find a regression [9] caused by the jQuery changes, please report it in Drupal core's issue queue [10] (or that of the relevant contrib project). However, if you believe you have found a security issue, please report it privately to the Drupal Security Team [11]. Solution: Install the latest version: * If you are using Drupal 8.8, upgrade to Drupal 8.8.6 [12]. * If you are using Drupal 8.7, upgrade to Drupal 8.7.14 [13]. * If you are using Drupal 7, upgrade to Drupal 7.70 [14]. Versions of Drupal 8 prior to 8.7 are end-of-life and do not receive security coverage. Sites on 8.6 or earlier should update to 8.7.14. The pre-release Drupal versions (8.9 and 9.0) have been updated jQuery to version 3.5.1 as of 8.9.0-beta3 and 9.0.0-beta3. Reported By: * Drew Webber [15] of the Drupal Security Team * Emerson Jair Reis Oliveira da Silva [16] Fixed By: * Drew Webber [17] of the Drupal Security Team * Sally Young [18] * cilefen [19] of the Drupal Security Team * Jess [20] of the Drupal Security Team * Emerson Jair Reis Oliveira da Silva [21] * Lee Rowlands [22] of the Drupal Security Team * Alex Bronstein [23] of the Drupal Security Team * Ben Mullins [24] * Lauri Eskola [25] * Peter Weber [26] * Samuel Mortenson [27] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://blog.jquery.com/2020/05/04/jquery-3-5-1-released-fixing-a-regressio… [4] https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 [5] https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 [6] https://www.drupal.org/project/jquery_update [7] https://jquery.com/upgrade-guide/3.5/#description-of-the-change [8] https://html.spec.whatwg.org/multipage/custom-elements.html [9] https://en.wikipedia.org/wiki/Software_regression [10] https://www.drupal.org/project/issues/drupal [11] https://www.drupal.org/security-team/report-issue [12] https://www.drupal.org/project/drupal/releases/8.8.6 [13] https://www.drupal.org/project/drupal/releases/8.7.14 [14] https://www.drupal.org/project/drupal/releases/7.70 [15] https://www.drupal.org/user/255969 [16] https://www.drupal.org/user/3580914 [17] https://www.drupal.org/user/255969 [18] https://www.drupal.org/user/161058 [19] https://www.drupal.org/user/1850070 [20] https://www.drupal.org/user/65776 [21] https://www.drupal.org/user/3580914 [22] https://www.drupal.org/user/395439 [23] https://www.drupal.org/user/78040 [24] https://www.drupal.org/user/2369194 [25] https://www.drupal.org/user/1078742 [26] https://www.drupal.org/user/1448368 [27] https://www.drupal.org/user/2582268

1 0

reCAPTCHA v3 - Critical - Access bypass - SA-CONTRIB-2020-019
by security-news＠drupal.org 13 May '20

13 May '20

View online: https://www.drupal.org/sa-contrib-2020-019 Project: reCAPTCHA v3 [1] Date: 2020-May-13 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The reCaptcha v3 module enables you to protect your forms using the Google reCaptcha V3. If the reCaptcha v3 challenge succeeds, all the other form validations are bypassed. This makes it possible for attackers to submit invalid or incomplete forms. This vulnerability only affects forms that are protected by reCaptcha v3 and have server side validation steps (e.g required field or custom validation functions). Solution: Install the latest version: * If you use the reCAPTCHA v3 module for Drupal 8.x, upgrade to reCAPTCHA v3 8.x-1.2 [3] Also see the reCAPTCHA v3 [4] project page. Reported By: * arnaudvz [5] * Martijn Vermeulen [6] Fixed By: * Denis V***** [7] * Majid Ali Khan [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/recaptcha_v3 [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/recaptcha_v3/releases/8.x-1.2 [4] https://www.drupal.org/project/recaptcha_v3 [5] https://www.drupal.org/user/3628871 [6] https://www.drupal.org/user/960720 [7] https://www.drupal.org/user/896504 [8] https://www.drupal.org/user/1271330 [9] https://www.drupal.org/user/36762

1 0

Webform - Critical - Access bypass - SA-CONTRIB-2020-018
by security-news＠drupal.org 13 May '20

13 May '20

View online: https://www.drupal.org/sa-contrib-2020-018 Project: Webform [1] Date: 2020-May-13 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This webform module enables you to build a 'Term checkboxes' element. The module doesn't sufficiently check term 'view' access when rendering 'Term checkboxes' elements. Unpublished terms will always appear in the 'Term checkboxes' element. Solution: Install the latest version: * If you use the Webform module for Drupal 8.x, upgrade to Webform 8.x-5.12 [3] Also see the Webform [4] project page. Reported By: * Joseph Zhao [5] Fixed By: * Joseph Zhao [6] * Lee Rowlands [7] of the Drupal Security Team * Jacob Rockowitz [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.12 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/1987218 [6] https://www.drupal.org/user/1987218 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/371407 [9] https://www.drupal.org/user/36762

1 0

Webform - Moderately critical - Access bypass - SA-CONTRIB-2020-017
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-017 Project: Webform [1] Date: 2020-May-06 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module enables you to build forms and surveys in Drupal. The Webform Node sub-module allows these forms to be associated with a Drupal node. The Webform Node module does not implement access checking in the same manner as other nodes and entities. As such, writers of custom modules which implement webform_node, node, or entity access checks may not achieve the intended access results for Webform Node content. There is no known exploit of this vulnerability and the vulnerability only exists on sites with custom code and a node access module in use. Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * Dan Chadwick [5] Fixed By: * Dan Chadwick [6] * Jacob Rockowitz [7] * Liam Morland [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/504278 [6] https://www.drupal.org/user/504278 [7] https://www.drupal.org/user/371407 [8] https://www.drupal.org/user/493050 [9] https://www.drupal.org/user/36762

1 0