View online: https://www.drupal.org/sa-contrib-2018-044
Project: TFA Basic plugins [1]
Version: 7.x-1.0
Date: 2018-June-27
Security risk: *Less critical* 9∕25
AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Insecure Randomness
Description:
The TFA Basic module enables you to use Two Factor Authentication via a
variety of plugins including TOTP and one-time codes delivered via email or
sms.
The module doesn't use a strong source of randomness, creating weak and
predictable one-time login codes that are then delivered using SMS. This
weakness does not affect the more common TOTP second factor.
This vulnerability is mitigated by the fact that the site must be configured
to use SMS to deliver one-time login codes which is an uncommon
configuration.
Solution:
* If you use the TFA Basic module for Drupal 7.x, upgrade to TFA Basic
7.x-1.1 [3]
Also see the TFA Basic plugins [4] project page.
Reported By:
* Greg Knaddison [5] of the Drupal Security Team
Fixed By:
* Greg Knaddison [6] of the Drupal Security Team
* Ben Jeavons [7] of the Drupal Security Team
Coordinated By:
* Greg Knaddison [8] of the Drupal Security Team
[1] https://www.drupal.org/project/tfa_basic
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/tfa_basic/releases/7.x-1.1
[4] https://www.drupal.org/project/tfa_basic
[5] https://www.drupal.org/user/36762
[6] https://www.drupal.org/user/36762
[7] https://www.drupal.org/user/91990
[8] https://www.drupal.org/u/greggles
View online: https://www.drupal.org/sa-contrib-2018-042
Project: Generate Password [1]
Version: 7.x-1.x-dev
Date: 2018-June-27
Security risk: *Less critical* 9∕25
AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Insecure Randomness
Description:
The Genpass module makes the password field optional (or hidden) on the add
new user page (admin & registration). If the password field is not set during
registration, the system generates a password.
The module doesn't use a strong source of randomness, creating weak and
predictable passwords.
This vulnerability is mitigated by the fact that the site must be configured
to reveal the password to the attacker which is a common configuration.
-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------
* /A CVE identifier [3] will be requested, and added upon issuance, in
accordance with Drupal Security Team processes./
Solution:
Install the latest version:
* If you use the Genpass module for Drupal 7.x-1.x, upgrade to Genpass
7.x-1.1 [4]
Also see the Generate Password [5] project page.
Reported By:
* Greg Knaddison [6] of the Drupal Security Team
Fixed By:
* Joel Stein [7] a module maintainer
Coordinated By:
* Greg Knaddison [8] of the Drupal Security Team
[1] https://www.drupal.org/project/genpass
[2] https://www.drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] https://www.drupal.org/project/genpass/releases/7.x-1.1
[5] https://www.drupal.org/project/genpass
[6] https://www.drupal.org/user/36762
[7] https://www.drupal.org/user/36598
[8] https://www.drupal.org/u/greggles