Security-news

security-news@drupal.org

1 participants
1782 discussions

Fraction - Less critical - XSS vulnerability - SA-CONTRIB-2018-059
by security-news＠drupal.org 05 Sep '18

05 Sep '18

View online: https://www.drupal.org/sa-contrib-2018-059 Project: Fraction [1] Date: 2018-September-05 Security risk: *Less critical* 5∕25 6/25 ( Less Critical) AC:Complex/A:Admin/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: XSS vulnerability Description: This module enables you to create fields for storing decimal values as two integers (numerator and denominator) for maximum precision. The module doesn't sufficiently filter XSS strings out of field labels. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to manage field configuration. Solution: Install the latest version: * If you use the Fraction module for Drupal 7.x, upgrade to Fraction 7.x-1.7 [3]. * If you use the Fraction module for Drupal 8.x, upgrade to Fraction 8.x-1.2 [4]. Also see the Fraction project page [5]. Reported By: * bucefal91 [6] Fixed By: * bucefal91 [7] * Michael Stenta [8], the module maintainer. Coordinated By: * Michael Hess [9] of the security team. [1] https://www.drupal.org/project/fraction [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/fraction/releases/7.x-1.7 [4] https://www.drupal.org/project/fraction/releases/8.x-1.2 [5] https://www.drupal.org/project/fraction [6] https://www.drupal.org/user/504128 [7] https://www.drupal.org/user/504128 [8] https://www.drupal.org/user/581414 [9] https://www.drupal.org/u/mlhess

1 0

Bing Autosuggest API - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-058
by security-news＠drupal.org 29 Aug '18

29 Aug '18

View online: https://www.drupal.org/sa-contrib-2018-058 Project: Bing Autosuggest API [1] Version: 7.x-1.x-dev Date: 2018-August-29 Security risk: *Moderately critical* 13∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables you to use the Bing Autosuggest API. The module doesn't sufficiently sanitize a value used to populate an API request. Solution: Install the latest version: * If you use the Bing Autosuggest API module for Drupal 7.x, upgrade to Bing Autosuggest API 7.x-1.1 [3] Also see the Bing Autosuggest API [4] project page. Reported By: * Drew Webber [5]Provisional Security Team Member Fixed By: * Drew Webber [6] * Alex Sansom [7] Coordinated By: * Drew Webber [8]Provisional Security Team Member [1] https://www.drupal.org/project/bing_autosuggest_api [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/bing_autosuggest_api/releases/7.x-1.1 [4] https://www.drupal.org/project/bing_autosuggest_api [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/255969 [7] https://www.drupal.org/user/364473 [8] https://www.drupal.org/user/255969

1 0

Drupal Commerce - Moderately critical - Access bypass - SA-CONTRIB-2018-057
by security-news＠drupal.org 29 Aug '18

29 Aug '18

View online: https://www.drupal.org/sa-contrib-2018-057 Project: Drupal Commerce [1] Version: 8.x-2.x-dev Date: 2018-August-29 Security risk: *Moderately critical* 14∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module enables you to build eCommerce websites and applications with Drupal. The module doesn't sufficiently check access for some of its entity types. Solution: Update to Commerce 8.x-2.9. [3] Reported By: * Samuel Mortenson [4] of the Drupal Security Team Fixed By: * Samuel Mortenson [5] of the Drupal Security Team * Matt Glaman [6] * Bojan Živanović [7] * Wim Leers [8] Coordinated By: * Samuel Mortenson [9] of the Drupal Security Team [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce/releases/8.x-2.9 [4] https://www.drupal.org/user/2582268 [5] https://www.drupal.org/user/2582268 [6] https://www.drupal.org/user/2416470 [7] https://www.drupal.org/user/86106 [8] https://www.drupal.org/user/99777 [9] https://www.drupal.org/user/2582268

1 0

File (Field) Paths - Critical - Remote Code Execution - SA-CONTRIB-2018-056
by security-news＠drupal.org 15 Aug '18

15 Aug '18

View online: https://www.drupal.org/sa-contrib-2018-056 Project: File (Field) Paths [1] Date: 2018-August-15 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:All/E:Theoretical/TD:Default [2] Vulnerability: Remote Code Execution Description: This module enables you to automatically sort and rename your uploaded files using token based replacement patterns to maintain a nice clean filesystem. The module doesn't sufficiently sanitize the path while a new file is uploading, allowing a remote attacker to execute arbitrary PHP code. This vulnerability is mitigated by the fact that an attacker must have access to a form containing a widget processed by this module. Solution: Install the latest version: * If you use the filefield_paths module for Drupal 7.x, upgrade to filefield_paths 7.x-1.1 [3] Reported By: * Wayne Eaker [4] Fixed By: * Oleh Vehera [5] Coordinated By: * Michael Hess [6] of the Drupal Security Team [1] https://www.drupal.org/project/filefield_paths [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/filefield_paths/releases/7.x-1.1 [4] https://www.drupal.org/user/326925 [5] https://www.drupal.org/user/3260314 [6] https://www.drupal.org/u/mlhess

1 0

PHP Configuration - Critical - Arbitrary PHP code execution - SA-CONTRIB-2018-055
by security-news＠drupal.org 08 Aug '18

08 Aug '18

View online: https://www.drupal.org/sa-contrib-2018-055 Project: PHP Configuration [1] Version: 8.x-1.07.x-1.0 Date: 2018-August-08 Security risk: *Critical* 17∕25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Arbitrary PHP code execution Description: This module enables you to add or overwrite PHP configuration on a drupal website. The module doesn't sufficiently allow access to set these configurations, leading to arbitrary PHP configuration execution by an attacker. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer phpconfig". After updating the module, it's important to review the permissions of your website and if 'administer phpconfig' permission is given to a not fully trusted user role, we advise to revoke it. Solution: Install the latest version: * If you use the PHP Configuration module for Drupal 7.x, upgrade to PHP Configuration 7.x-1.1 * If you use the PHP Configuration module for Drupal 8.x, upgrade to PHP Configuration 8.x-1.1 Also see the PHP Configuration [3] project page. Reported By: * Balazs Janos Tatar [4] Provisional security team member Fixed By: * bappa.sarkar [5] The module maintainer Coordinated By: * mpotter [6] of the Drupal Security Team [1] https://www.drupal.org/project/phpconfig [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/phpconfig [4] https://www.drupal.org/u/tatarbj [5] https://www.drupal.org/user/262655 [6] https://www.drupal.org/u/mpotter

1 0

Drupal Core - 3rd-party libraries -SA-CORE-2018-005
by security-news＠drupal.org 01 Aug '18

01 Aug '18

View online: https://www.drupal.org/SA-CORE-2018-005 * Advisory ID: SA-CORE-2018-005 * Project: Drupal core [1] * Version: 8.x * CVE: CVE-2018-14773 * Date: 2018-August-01 -------- DESCRIPTION --------------------------------------------------------- The Drupal project uses the Symfony library. The Symfony library has released a security update that impacts Drupal. Refer to the Symfony security advisory for the issue [2]. The same vulnerability also exists in the Zend Feed and Diactoros libraries included in Drupal core; however, Drupal core does not use the vulnerable functionality. If your site or module uses Zend Feed or Diactoros directly, read the Zend Framework security advisory [3] and update or patch as needed. The Drupal Security Team would like to to thank the Symfony and Zend Security teams for their collaboration on this issue. -------- VERSIONS AFFECTED --------------------------------------------------- 8.x versions before 8.5.6. -------- SOLUTION ------------------------------------------------------------ Upgrade to Drupal 8.5.6. Versions of Drupal 8 prior to 8.5.x are end-of-life and do not receive security coverage. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [4]. Learn more about the Drupal Security team and their policies [5], writing secure code for Drupal [6], and securing your site [7]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [8] [1] https://www.drupal.org/project/drupal [2] https://symfony.com/cve-2018-14773 [3] https://framework.zend.com/security/advisory/ZF2018-01 [4] https://www.drupal.org/contact [5] https://www.drupal.org/security-team [6] https://www.drupal.org/writing-secure-code [7] https://www.drupal.org/security/secure-configuration [8] https://twitter.com/drupalsecurity

1 0

Drupal 8 release on August 1st, 2018 - DRUPAL-PSA-2018-07-30
by security-news＠drupal.org 30 Jul '18

30 Jul '18

View online: https://www.drupal.org/psa-2018-07-30 The Drupal Security Team will be coordinating a security release for Drupal 8 this week on Wednesday, August 1, 2018. (We are issuing this PSA in advance because the in the regular security release window schedule [1], August 1 would not typically be a core security window.) The Drupal 8 core release will be made between noon and 3pm EDT. It is rated as moderately critical. The core release will be an update to a vendor library only. August 1 also remains a normal security release window for contributed projects. [1] https://www.drupal.org/node/1173280

1 0

Select (or other) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-054
by security-news＠drupal.org 25 Jul '18

25 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-054 Project: Select (or other) [1] Date: 2018-July-25 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables users to select 'other' on certain form elements and a textfield appears for the user to provide a custom value. The module doesn't sufficiently escape values of a text field the under the scenario when "Select or other" formatter is used. This vulnerability is mitigated by the fact that an attacker must have access to edit a field that is displayed through the "Select or other" formatter. Solution: * If you use the "Select or other" 7.x-2.x, upgrade to Select or other 7.x-2.24 [3] * If you use the "Select or other" 7.x-3.x, upgrade to Select or other 7.x-3.0-alpha3 [4] Also see the Select (or other) [5] project page. Reported By: * bucefal91 [6] Fixed By: * Chris Jansen [7], the module maintainer Coordinated By: * Michael Hess [8] of the Drupal Security Team [1] https://www.drupal.org/project/select_or_other [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/select_or_other/releases/7.x-2.24 [4] https://www.drupal.org/project/select_or_other/releases/7.x-3.0-alpha3 [5] https://www.drupal.org/project/select_or_other [6] https://www.drupal.org/user/504128 [7] https://www.drupal.org/user/2480548 [8] https://www.drupal.org/u/mlhess

1 0

XML sitemap - Moderately critical - Information Disclosure - SA-CONTRIB-2018-053
by security-news＠drupal.org 18 Jul '18

18 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-053 Project: XML sitemap [1] Date: 2018-July-18 Security risk: *Moderately critical* 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information Disclosure Description: This module enables you to generate XML sitemaps and it helps search engines to more intelligently crawl a website and keep their results up to date. The module doesn't sufficiently handle access rights under the scenario of updating contents from cron execution. Solution: * If you use the XML sitemap module for Drupal 7.x, upgrade to XML sitemap 7.x-2.4 [3] Also see the XML sitemap [4] project page. Reported By: * Balazs Janos Tatar [5] Provisional Security Team member Fixed By: * Balazs Janos Tatar [6] * jtsnow [7] * Tushar Thatikonda [8] Coordinated By: * Michael Hess [9] of the Drupal Security Team [1] https://www.drupal.org/project/xmlsitemap [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/2986578 [4] https://www.drupal.org/project/xmlsitemap [5] https://www.drupal.org/user/649590 [6] https://www.drupal.org/user/649590 [7] https://www.drupal.org/user/171614 [8] https://www.drupal.org/user/1835276 [9] https://www.drupal.org/u/mlhess

1 0

Taxonomy Entity Queue - Critical - SQL Injection - SA-CONTRIB-2018-052
by security-news＠drupal.org 18 Jul '18

18 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-052 Project: Taxonomy Entity Queue [1] Date: 2018-July-18 Security risk: *Critical* 17∕25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: SQL Injection Description: This module enables you to create an entityqueue based on a taxonomy. The module did not properly use Drupal's database API when querying the database with user supplied values, allowing an attacker to send a specially crafted request to modify the query or potentially perform additional queries. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer entity queue taxonomy" permission. Solution: Install the latest version: * If you use the Taxonomy Entity Queue module for Drupal 7.x, upgrade to Taxonomy Entity Queue 7.x-1.1 [3] Also see the Taxonomy Entity Queue [4] project page. Reported By: * Drew Webber [5] Fixed By: * Bappa Sarkar [6] * Drew Webber [7] Coordinated By: * Michael Hess [8] of the Drupal Security Team [1] https://www.drupal.org/project/entityqueue_taxonomy [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entityqueue_taxonomy/releases/7.x-1.1 [4] https://www.drupal.org/project/entityqueue_taxonomy [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/262655 [7] https://www.drupal.org/user/255969 [8] https://www.drupal.org/u/mlhess

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news