- Security-news - lists.drupal.org

Drupal core - Moderately critical - Third-party library - SA-CORE-2020-001
by security-news＠drupal.org 18 Mar '20

18 Mar '20

View online: https://www.drupal.org/sa-core-2020-001 Project: Drupal core [1] Version: 8.8.x-dev8.7.x-dev Date: 2020-March-18 Security risk: *Moderately critical* 13∕25 AC:Complex/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Third-party library Description: The Drupal project uses the third-party library CKEditor [3], which has released a security improvement [4] that is needed to protect some Drupal configurations. Vulnerabilities are possible if Drupal is configured to use the WYSIWYG CKEditor for your site’s users. When multiple people can edit content, the vulnerability can be used to execute XSS attacks against other people, including site admins with more access. The latest versions of Drupal update CKEditor to 4.14 to mitigate the vulnerabilities. Solution: Install the latest version: * If you are using Drupal 8.8.x, upgrade to Drupal 8.8.4 [5]. * If you are using Drupal 8.7.x, upgrade to Drupal 8.7.12 [6]. Versions of Drupal 8 prior to 8.7.x have reached end-of-life and do not receive security coverage. The CKEditor module can also be disabled to mitigate the vulnerability until the site is updated. .... Note for Drupal 7 users Drupal 7 core is not affected by this release; however, users who have installed the third-party CKEditor library (for example, with a contributed module) should ensure that the downloaded library is updated to CKEditor 4.14 or higher, or that CDN URLs point to a version of CKEditor 4.14 or higher. Disabling all WYSIWYG modules can mitigate the vulnerability until the site is updated. [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/ckeditor/ckeditor4 [4] https://ckeditor.com/blog/CKEditor-4.14-with-Paste-from-LibreOffice-release… [5] https://www.drupal.org/project/drupal/releases/8.8.4 [6] https://www.drupal.org/project/drupal/releases/8.7.12

1 0

SAML Service Provider - Critical - Access bypass - SA-CONTRIB-2020-006
by security-news＠drupal.org 11 Mar '20

11 Mar '20

View online: https://www.drupal.org/sa-contrib-2020-006 Project: SAML Service Provider [1] Date: 2020-March-11 Security risk: *Critical* 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module enables you to authenticate Drupal users using an external SAML Identity Provider. If the site is configured to allow visitors to register for user accounts but administrator approval is required, the module doesn't sufficiently enforce the administrative approval requirement, in the case where the requesting user has already authenticated through SAML. This vulnerability is mitigated by the fact that user accounts created in this way have only default roles, which may not have access significantly beyond that of an anonymous user. To mitigate the vulnerability without upgrading sites could disable public registration. Solution: Install the latest version: * If you use the SAML Service Provider module for Drupal 8.x, upgrade to SAML Service Provider 8.x-3.7 [3] Also see the SAML Service Provider [4] project page. Reported By: * J Proctor [5] Fixed By: * J Proctor [6] * James Glasgow [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/saml_sp [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/saml_sp/releases/8.x-3.7 [4] https://www.drupal.org/project/saml_sp [5] https://www.drupal.org/user/1194192 [6] https://www.drupal.org/user/1194192 [7] https://www.drupal.org/user/36590 [8] https://www.drupal.org/user/36762

1 0

SVG Formatter - Critical - Cross site scripting - SA-CONTRIB-2020-005
by security-news＠drupal.org 04 Mar '20

04 Mar '20

View online: https://www.drupal.org/sa-contrib-2020-005 Project: SVG Formatter [1] Date: 2020-March-04 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Cross site scripting Description: SVG Formatter module provides support for using SVG images on your website. This security release fixes third-party dependencies included in or required by SVG Formatter. XSS bypass using entities and tab [3]. This vulnerability is mitigated by the fact that an attacker must be able to upload SVG files. Solution: Install the latest version: * If you use the SVG Formatter module for Drupal 8.x, upgrade to SVG Formatter 8.x-1.12 [4] Also see the SVG Formatter [5] project page. Reported By: * Jeroen Tubex [6] Fixed By: * Goran Nikolovski [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/svg_formatter [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/darylldoyle/svg-sanitizer/issues/31 [4] https://www.drupal.org/project/svg_formatter/releases/8.x-1.12 [5] https://www.drupal.org/project/svg_formatter [6] https://www.drupal.org/user/2228934 [7] https://www.drupal.org/user/3451979 [8] https://www.drupal.org/user/36762

1 0

Profile - Moderately critical - Access Bypass - SA-CONTRIB-2020-004
by security-news＠drupal.org 19 Feb '20

19 Feb '20

View online: https://www.drupal.org/sa-contrib-2020-004 Project: Profile [1] Date: 2020-February-19 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access Bypass Description: The Profile module enables you to allow users to have configurable user profiles. The module doesn't sufficiently check access when creating a user profile. Users with the "create profiles" permission could create profiles for any users. Solution: Install the latest version: * If you use the Profile module for Drupal 8.x, upgrade to Profile 8.x-1.1 [3] Also see the Profile [4] project page. Reported By: * karl972 [5] Fixed By: * Matt Glaman [6] * Bojan Živanović [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/profile [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/profile/releases/8.x-1.1 [4] https://www.drupal.org/project/profile [5] https://www.drupal.org/user/1541584 [6] https://www.drupal.org/user/2416470 [7] https://www.drupal.org/user/86106 [8] https://www.drupal.org/user/36762

1 0

Views Bulk Operations (VBO) - Moderately critical - Access bypass - SA-CONTRIB-2020-003
by security-news＠drupal.org 05 Feb '20

05 Feb '20

View online: https://www.drupal.org/sa-contrib-2020-003 Project: Views Bulk Operations (VBO) [1] Date: 2020-February-05 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: Views Bulk Operations provides enhancements to running bulk actions on views. The module contains an access bypass vulnerability that might allow users to execute views actions that they should not have access to. This vulnerability is mitigated by the fact that it only occurs in the case of customised action access (by means of hook_action_info_alter). Solution: Install the latest version: * If you use Views Bulk Operations version 3.x for Drupal 8.x, upgrade to Views Bulk Operations 8.x-3.4 [3] * If you use Views Bulk Operations version 2.x for Drupal 8.x, upgrade to Views Bulk Operations 8.x-2.6 [4] Also see the Views Bulk Operations (VBO) [5] project page. Reported By: * Adam Shepherd [6] Fixed By: * Adam Shepherd [7] * Marcin Grabias [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/views_bulk_operations [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/views_bulk_operations/releases/8.x-3.4 [4] https://www.drupal.org/project/views_bulk_operations/releases/8.x-2.6 [5] https://www.drupal.org/project/views_bulk_operations [6] https://www.drupal.org/user/2650563 [7] https://www.drupal.org/user/2650563 [8] https://www.drupal.org/user/1599440 [9] https://www.drupal.org/user/36762

1 0

SpamSpan filter - Moderately critical - Cross site scripting - SA-CONTRIB-2020-002
by security-news＠drupal.org 22 Jan '20

22 Jan '20

View online: https://www.drupal.org/sa-contrib-2020-002 Project: SpamSpan filter [1] Date: 2020-January-22 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Description: The SpamSpan module obfuscates email addresses to help prevent spambots from collecting them. This module contains a spamspan twig filter which doesn't sanitize the passed HTML string. This vulnerability is mitigated by the fact that sites must have custom twig template files that use the SpamSpan filter on a field that an attacker could populate. By default the SpamSpan module does not use the vulnerable twig filter. Solution: Install the latest version: * If you use the SpamSpan module for Drupal 8.x, upgrade to SpamSpan 8.x-1.1 [3] Also see the SpamSpan filter [4] project page. Reported By: * Jeroen Tubex [5] Fixed By: * Jeroen Tubex [6] * vitalie [7] Coordinated By: * Ben Jeavons [8] of the Drupal Security Team [1] https://www.drupal.org/project/spamspan [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/spamspan/releases/8.x-1.1 [4] https://www.drupal.org/project/spamspan [5] https://www.drupal.org/user/2228934 [6] https://www.drupal.org/user/2228934 [7] https://www.drupal.org/user/175134 [8] https://www.drupal.org/u/coltrane

1 0

Radix - Moderately critical - Cross site scripting - SA-CONTRIB-2020-001
by security-news＠drupal.org 15 Jan '20

15 Jan '20

View online: https://www.drupal.org/sa-contrib-2020-001 Project: Radix [1] Date: 2020-January-15 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: Radix is a base theme for Drupal, with Bootstrap 4, Sass, ES6 and BrowserSync built-in. The module doesn't sufficiently filter menu titles when used in a dropdown in the main menu. This vulnerability is mitigated by the fact that an attacker must have permission to edit a menu title used in the main menu. Solution: Install the latest version: * If you use the Radix theme for Drupal 7.x, upgrade to Radix 7.x-3.8 [3] Also see the Radix [4] project page. Reported By: * annagaz [5] Fixed By: * David Snopek [6] of the Drupal Security Team Coordinated By: * David Snopek [7] of the Drupal Security Team [1] https://www.drupal.org/project/radix [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/radix/releases/7.x-3.8 [4] https://www.drupal.org/project/radix [5] https://www.drupal.org/user/2741499 [6] https://www.drupal.org/user/266527 [7] https://www.drupal.org/user/266527

1 0

Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2019-010
by security-news＠drupal.org 18 Dec '19

18 Dec '19

View online: https://www.drupal.org/sa-core-2019-010 Project: Drupal core [1] Version: 8.8.x-dev8.7.x-dev Date: 2019-December-18 Security risk: *Moderately critical* 14∕25 AC:Basic/A:Admin/CI:Some/II:All/E:Theoretical/TD:Default [2] Vulnerability: Multiple vulnerabilities Description: Drupal 8 core's file_save_upload() function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did. Users with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to bypass protections afforded by Drupal's default .htaccess file. After this fix, file_save_upload() now trims leading and trailing dots from filenames. Solution: Install the latest version: * If you use Drupal core 8.7.x: 8.7.11 [3] * If you use Drupal core 8.8.x: 8.8.1 [4] Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage. Reported By: * Rohit Kapur [5] * Filipe Reis [6] * Dan Reif [7] * mramydnei [8] Fixed By: * Lee Rowlands [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team * Michael Hess [11] of the Drupal Security Team * Kim Pepper [12] * Alex Pott [13] of the Drupal Security Team * Derek Wright [14] * Jess [15] of the Drupal Security Team * David Rothstein [16] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/8.7.11 [4] https://www.drupal.org/project/drupal/releases/8.8.1 [5] https://www.drupal.org/user/3623849 [6] https://www.drupal.org/user/3521501 [7] https://www.drupal.org/user/454444 [8] https://www.drupal.org/user/3529990 [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/102818 [12] https://www.drupal.org/user/370574 [13] https://www.drupal.org/user/157725 [14] https://www.drupal.org/user/46549 [15] https://www.drupal.org/user/65776 [16] https://www.drupal.org/user/124982

1 0

Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012
by security-news＠drupal.org 18 Dec '19

18 Dec '19

View online: https://www.drupal.org/sa-core-2019-012 Project: Drupal core [1] Version: 8.8.x-dev8.7.x-dev7.x-dev Date: 2019-December-18 Security risk: *Critical* 17∕25 AC:Basic/A:User/CI:All/II:All/E:Proof/TD:Uncommon [2] Vulnerability: Multiple vulnerabilities Description: The Drupal project uses the third-party library Archive_Tar [3], which has released a security update that impacts some Drupal configurations. Multiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them. The latest versions of Drupal update Archive_Tar to 1.4.9 to mitigate the file processing vulnerabilities. Solution: Install the latest version: * If you are using Drupal 7.x, upgrade to Drupal 7.69 [4]. * If you are using Drupal 8.7.x, upgrade to Drupal 8.7.11 [5]. * If you are using Drupal 8.8.x, upgrade to Drupal 8.8.1 [6]. Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage. Reported By: * Jasper Mattsson [7] Fixed By: * Lee Rowlands [8] of the Drupal Security Team * Peter Wolanin [9] of the Drupal Security Team * Sam Becker [10] * Jasper Mattsson [11] * David Rothstein [12] of the Drupal Security Team * michieltcs [13] * Ayesh Karunaratne [14] * Alex Pott [15] of the Drupal Security Team * Jess [16] of the Drupal Security Team * Samuel Mortenson [17] of the Drupal Security Team * Vijaya Chandran Mani [18] * Drew Webber [19] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://pear.php.net/package/Archive_Tar/ [4] https://www.drupal.org/project/drupal/releases/7.69 [5] https://www.drupal.org/project/drupal/releases/8.7.11 [6] https://www.drupal.org/project/drupal/releases/8.8.1 [7] https://www.drupal.org/user/521118 [8] https://www.drupal.org/user/395439 [9] https://www.drupal.org/user/49851 [10] https://www.drupal.org/user/1485048 [11] https://www.drupal.org/user/521118 [12] https://www.drupal.org/user/124982 [13] https://www.drupal.org/user/3587972 [14] https://www.drupal.org/user/796148 [15] https://www.drupal.org/user/157725 [16] https://www.drupal.org/user/65776 [17] https://www.drupal.org/user/2582268 [18] https://www.drupal.org/user/93488 [19] https://www.drupal.org/user/255969

1 0

Drupal core - Moderately critical - Access bypass - SA-CORE-2019-011
by security-news＠drupal.org 18 Dec '19

18 Dec '19

View online: https://www.drupal.org/sa-core-2019-011 Project: Drupal core [1] Version: 8.8.x-dev8.7.x-dev Date: 2019-December-18 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations. Solution: * If you are using Drupal 8.7.x, you should upgrade to Drupal 8.7.11 [3]. * If you are using Drupal 8.8.x, you should upgrade to Drupal 8.8.1 [4]. Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage. Alternatively, you may mitigate this vulnerability by unchecking the "Enable advanced UI" checkbox on /admin/config/media/media-library. (This mitigation is not available in 8.7.x.) Reported By: * Adam G-H [5] Fixed By: * Adam G-H [6] * Jess [7] of the Drupal Security Team * Andrei Mateescu [8] * Greg Knaddison [9] of the Drupal Security Team * Alex Bronstein [10] of the Drupal Security Team * Sean Blommaert [11] * Lee Rowlands [12] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://security.drupal.org/project/drupal/releases/8.7.11 [4] https://security.drupal.org/project/drupal/releases/8.8.1 [5] https://www.drupal.org/user/205645 [6] https://www.drupal.org/user/205645 [7] https://www.drupal.org/user/65776 [8] https://www.drupal.org/user/729614 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/78040 [11] https://www.drupal.org/user/545912 [12] https://www.drupal.org/user/395439

1 0