- Security-news - lists.drupal.org

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2019-003
by security-news＠drupal.org 20 Feb '19

20 Feb '19

View online: https://www.drupal.org/sa-core-2019-003 Project: Drupal core [1] Date: 2019-February-20 Security risk: *Highly critical* 20∕25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote Code Execution CVE IDs: CVE-2019-6340 Description: Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: * The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or * the site has another web services module enabled (like JSON:API [3] in Drupal 8, or Services [4] or RESTful Web Services [5] in Drupal 7). Solution: * If you are using Drupal 8.6.x, upgrade to Drupal 8.6.10 [6]. * If you are using Drupal 8.5.x or earlier, upgrade to Drupal 8.5.11 [7]. * Be sure to install any available security updates for contributed projects [8] after updating Drupal core. * No core update is required for Drupal 7, but several Drupal 7 contributed modules [9] do require updates. Versions of Drupal 8 prior to 8.5.x are end-of-life and do not receive security coverage. To immediately mitigate the vulnerability, you can disable all web services modules, or configure your web server(s) to not allow PUT/PATCH/POST requests to web services resources. Note that web services resources may be available on multiple paths depending on the configuration of your server(s). For Drupal 7, resources are for example typically available via paths (clean URLs) and via arguments to the "q" query argument. For Drupal 8, paths may still function when prefixed with index.php/. Reported By: * Samuel Mortenson [10] of the Drupal Security Team Fixed By: * Sascha Grossenbacher [11] * Peter Wolanin [12] of the Drupal Security Team * Samuel Mortenson [13] of the Drupal Security Team * Daniel Wehner [14] * Cash Williams [15] of the Drupal Security Team * Wim Leers [16] * Jess [17] of the Drupal Security Team * Lee Rowlands [18] of the Drupal Security Team * Alex Pott [19] of the Drupal Security Team * Francesco Placella [20] * Damian Lee [21] * Tobias Zimmermann [22] * Ted Bowman [23] * Damien McKenna [24] of the Drupal Security Team * Alex Bronstein [25] of the Drupal Security Team * Rob Loach [26] * Gabe Sullice [27] * Michael Hess [28] of the Drupal Security Team * Neil Drumm [29] of the Drupal Security Team * Heshan Wanigasooriya [30] * David Snopek [31] of the Drupal Security Team * Wolfgang Ziegler [32] * Miro Dietiker [33] * Truls S. Yggeseth [34] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/jsonapi [4] https://www.drupal.org/project/services [5] https://www.drupal.org/project/restws [6] https://www.drupal.org/project/drupal/releases/8.6.10 [7] https://www.drupal.org/project/drupal/releases/8.5.11 [8] https://www.drupal.org/security/contrib [9] https://www.drupal.org/security/contrib [10] https://www.drupal.org/user/2582268 [11] https://www.drupal.org/user/214652 [12] https://www.drupal.org/user/49851 [13] https://www.drupal.org/user/2582268 [14] https://www.drupal.org/user/99340 [15] https://www.drupal.org/user/421070 [16] https://www.drupal.org/user/99777 [17] https://www.drupal.org/user/65776 [18] https://www.drupal.org/user/395439 [19] https://www.drupal.org/user/157725 [20] https://www.drupal.org/user/183211 [21] https://www.drupal.org/user/1037976 [22] https://www.drupal.org/user/107158 [23] https://www.drupal.org/user/240860 [24] https://www.drupal.org/user/108450 [25] https://www.drupal.org/user/78040 [26] https://www.drupal.org/user/61114 [27] https://www.drupal.org/user/2287430 [28] https://www.drupal.org/user/102818 [29] https://www.drupal.org/user/3064 [30] https://www.drupal.org/user/199102 [31] https://www.drupal.org/user/266527 [32] https://www.drupal.org/user/16747 [33] https://www.drupal.org/user/227761 [34] https://www.drupal.org/user/325866

1 0

Font Awesome Icons - Critical - Remote Code Execution - SA-CONTRIB-2019-025
by security-news＠drupal.org 20 Feb '19

20 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-025 Project: Font Awesome Icons [1] Date: 2019-February-20 Security risk: *Critical* 18∕25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote Code Execution Description: This resolves issues described in SA-CORE-2019-003 [3] for this module. Not all configurations are affected. See SA-CORE-2019-003 [4] for details. Solution: * If you use the Font Awesome Icons module for Drupal 8.x, upgrade to Font Awesome Icons 8.x-2.12 [5]. [1] https://www.drupal.org/project/fontawesome [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/sa-core-2019-003 [5] https://www.drupal.org/project/fontawesome/releases/8.x-2.12

1 0

Translation Management Tool - Critical - Remote Code Execution - SA-CONTRIB-2019-024
by security-news＠drupal.org 20 Feb '19

20 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-024 Project: Translation Management Tool [1] Date: 2019-February-20 Security risk: *Critical* 16∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote Code Execution Description: This resolves issues described in SA-CORE-2019-003 [3] for this module. Not all configurations are affected. See SA-CORE-2019-003 [4] for details. Solution: * If you use the TMGMT module for Drupal 8.x, upgrade to TMGMT 8.x-1.7 [5]. [1] https://www.drupal.org/project/tmgmt [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/sa-core-2019-003 [5] https://www.drupal.org/project/TMGMT/releases/8.x-1.7

1 0

Paragraphs - Critical - Remote Code Execution - SA-CONTRIB-2019-023
by security-news＠drupal.org 20 Feb '19

20 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-023 Project: Paragraphs [1] Date: 2019-February-20 Security risk: *Critical* 18∕25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote Code Execution Description: This resolves issues described in SA-CORE-2019-003 [3] for this module. Not all configurations are affected. See SA-CORE-2019-003 [4] for details. Solution: * If you use the Paragraphs module for Drupal 8.x, upgrade to Paragraphs 8.x-1.6 [5]. [1] https://www.drupal.org/project/paragraphs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/sa-core-2019-003 [5] https://www.drupal.org/project/paragraphs/releases/8.x-1.6

1 0

Video - Critical - Remote Code Execution - SA-CONTRIB-2019-022
by security-news＠drupal.org 20 Feb '19

20 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-022 Project: Video [1] Date: 2019-February-20 Security risk: *Critical* 18∕25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote Code Execution Description: This resolves issues described in SA-CORE-2019-003 [3] for this module. Not all configurations are affected. See SA-CORE-2019-003 [4] for details. Solution: Install the latest version: * If you use the Video module for Drupal 8, upgrade to Video 8.x-1.4 [5] [1] https://www.drupal.org/project/video [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/sa-core-2019-003 [5] https://www.drupal.org/project/video/releases/8.x-1.4

1 0

Metatag - Critical - Remote code execution - SA-CONTRIB-2019-021
by security-news＠drupal.org 20 Feb '19

20 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-021 Project: Metatag [1] Date: 2019-February-20 Security risk: *Critical* 18∕25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote code execution Description: This resolves issues described in SA-CORE-2019-003 [3] for this module. Not all configurations are affected. See SA-CORE-2019-003 [4] for details. Solution: * If you use the Metatag module for Drupal 8.x, upgrade to Metatag 8.x-1.8 [5]. [1] https://www.drupal.org/project/metatag [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/sa-core-2019-003 [5] https://www.drupal.org/project/metatag/releases/8.x-1.8

1 0

Link - Critical - Remote Code Execution - SA-CONTRIB-2019-020
by security-news＠drupal.org 20 Feb '19

20 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-020 Project: Link [1] Date: 2019-February-20 Security risk: *Critical* 18∕25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote Code Execution Description: This resolves issues described in SA-CORE-2019-003 [3] for this module. Not all configurations are affected. See SA-CORE-2019-003 [4] for details. Solution: Install the latest version: * If you use the Link module for Drupal 7.x, upgrade to Link 7.x-1.6 [5] [1] https://www.drupal.org/project/link [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/sa-core-2019-003 [5] https://www.drupal.org/project/link/releases/7.x-1.6

1 0

JSON:API - Highly critical - Remote code execution - SA-CONTRIB-2019-019
by security-news＠drupal.org 20 Feb '19

20 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-019 Project: JSON:API [1] Date: 2019-February-20 Security risk: *Highly critical* 22∕25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Remote code execution Description: This resolves issues described in SA-CORE-2019-003 [3] for this module. Solution: Install the latest version: * If you use the *2.x* version of the JSON:API module for Drupal 8.x, upgrade to JSON:API 8.x-2.3 [4] * If you use the *1.x* version of the JSON:API module for Drupal 8.x, upgrade to JSON:API 8.x-1.25 [5] [1] https://www.drupal.org/project/jsonapi [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/node/3034433 [5] https://www.drupal.org/node/3034431

1 0

RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2019-018
by security-news＠drupal.org 20 Feb '19

20 Feb '19

View online: https://www.drupal.org/sa-contrib-2019-018 Project: RESTful Web Services [1] Date: 2019-February-20 Security risk: *Critical* 19∕25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This resolves issues described in SA-CORE-2019-003 [3] for this module. Not all configurations are affected. See SA-CORE-2019-003 [4] for details. Solution: Install the latest version: * If you use the RESTful Web Services module for Drupal 7.x, upgrade to restws 7.x-2.8 [5] [1] https://www.drupal.org/project/restws [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/sa-core-2019-003 [5] https://www.drupal.org/project/restws/releases/7.x-2.8

1 0

Critical Release - PSA-2019-02-19
by security-news＠drupal.org 19 Feb '19

19 Feb '19

View online: https://www.drupal.org/psa-2019-02-19 Date: 2019-February-19 Security risk: *Highly critical* 20∕25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon [1] Vulnerability: Critical Release Description: There will be a *security release of 8.5.x and 8.6.x on February 20th 2019 between 1PM to 5PM America/New York* (1800 to 2200 UTC). (To see this in your local timezone, refer to the Drupal Core Calendar [2]) . The risk on this is currently rated at 20/25 (Highly critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon. Not all configurations are affected. Reserve time on February 20 during the release window to determine whether your sites are affected and in need of an immediate update. Mitigation information will be included in the advisory. Contributed module security updates may also be required. *If you are running Drupal 7*, no core update is required, but you may need to update contributed modules if you are using an affected module. We are unable to provide the list of those modules at this time. Neither the Security Team nor any other party is able to release any more information about this vulnerability until the announcement is made. The announcement will be made public at https://www.drupal.org/security [3], over Twitter, and in email for those who have subscribed to our email list. To subscribe to the email list: log in on Drupal.org, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab. Security release announcements will appear on the Drupal.org security advisory page. [1] https://www.drupal.org/security-team/risk-levels [2] https://calendar.google.com/calendar/r?cid=drupalcorecalendar@association.d… [3] https://www.drupal.org/security

1 0