- Security-news - lists.drupal.org

Drupal Core - Highly Critical - Public Service announcement - PSA-2018-002
by security-news＠drupal.org 13 Apr '18

13 Apr '18

View online: https://www.drupal.org/psa-2018-002 * Advisory ID: PSA-2018-002 * Project: Drupal core [1] * Version: 7.x, 8.x * Date: 2018-April-13 * Security risk: 25/25 (Highly Critical) AC:None/A:None/CI:All/II:All/E:Exploit/TD:All [2] -------- DESCRIPTION --------------------------------------------------------- This Public Service Announcement is a follow-up to SA-CORE-2018-002 - Drupal core - RCE [3]. This is *not* an announcement of a new vulnerability. If you have not updated your site as described in SA-CORE-2018-002 you should assume your site has been targeted and follow directions for remediation as described below. The security team is now aware of automated attacks attempting to compromise Drupal 7 and 8 websites using the vulnerability reported in SA-CORE-2018-002 [4]. Due to this, the security team is increasing the security risk score of that issue to 25/25 *Sites not patched by Wednesday, 2018-04-11 may be compromised.* This is the date when evidence emerged of automated attack attempts. It is possible targeted attacks occurred before that. *Simply updating Drupal will not remove backdoors or fix compromised sites.* If you find that your site is already patched, but you didn’t do it, that can be a symptom that the site was compromised. Some attacks in the past have applied the patch as a way to guarantee that only that attacker is in control of the site. .... What to do if your site may be compromised Attackers may have copied all data out of your site and could use it maliciously. There may be no trace of the attack. Take a look at our help documentation, ”Your Drupal site got hacked, now what.” [5] .... Recovery Attackers may have created access points for themselves (sometimes called “backdoors”) in the database, code, files directory and other locations. Attackers could compromise other services on the server or escalate their access. Removing a compromised website’s backdoors is difficult because it is very difficult to be certain all backdoors have been found. If you did not patch, you should restore from a backup. While recovery without restoring from backup may be possible, this is not advised because backdoors can be extremely difficult to find. The recommendation is to restore from backup or rebuild from scratch. For more information please refer to this guide on hacked sites. [6] -------- CONTACT AND MORE INFORMATION ---------------------------------------- We prepared a FAQ that was released when SA-CORE-2018-002 was published. Read more at FAQ on SA-CORE-2018-002 [7]. The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/SA-CORE-2018-002 [4] https://www.drupal.org//www.drupal.org/sa-core-2018-002 [5] https://www.drupal.org/node/2365547 [6] https://www.drupal.org/node/2365547 [7] https://groups.drupal.org/security/faq-2018-002 [8] https://www.drupal.org/contact [9] https://www.drupal.org/security-team [10] https://www.drupal.org/writing-secure-code [11] https://www.drupal.org/security/secure-configuration

1 0

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002
by security-news＠drupal.org 28 Mar '18

28 Mar '18

View online: https://www.drupal.org/sa-core-2018-002 Project: Drupal core [1] Date: 2018-March-28 Security risk: *Highly critical* 21∕25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Remote Code Execution Description: CVE: CVE-2018-7600 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. The security team has written an FAQ [3] about this issue. Solution: Upgrade to the most recent version of Drupal 7 or 8 core. * *If you are running 7.x, upgrade to Drupal 7.58 [4].* (If you are unable to update immediately, you can attempt to apply this patch [5] to fix the vulnerability until such time as you are able to completely update.) * *If you are running 8.5.x, upgrade to Drupal 8.5.1 [6].* (If you are unable to update immediately, you can attempt to apply this patch [7] to fix the vulnerability until such time as you are able to completely update.) Drupal 8.3.x and 8.4.x are no longer supported and we don't normally provide security releases for unsupported minor releases [8]. However, given the potential severity of this issue, we /are/ providing 8.3.x and 8.4.x releases that includes the fix for sites which have not yet had a chance to update to 8.5.0. Your site's update report page will recommend the 8.5.x release even if you are on 8.3.x or 8.4.x. Please take the time to update to a supported version after installing this security update. * If you are running 8.3.x, upgrade to Drupal 8.3.9 [9] or apply this patch [10]. * If you are running 8.4.x, upgrade to Drupal 8.4.6 [11] or apply this patch [12]. This issue also affects Drupal 8.2.x and earlier, which are no longer supported. If you are running any of these versions of Drupal 8, update to a more recent release and then follow the instructions above. This issue also affects Drupal 6. Drupal 6 is End of Life. For more information on Drupal 6 support please contact a D6LTS vendor [13]. Reported By: * Jasper Mattsson [14] Fixed By: * Jasper Mattsson [15] * Samuel Mortenson [16] Provisional Drupal Security Team member * David Rothstein [17] of the Drupal Security Team * Jess (xjm) [18] of the Drupal Security Team * Michael Hess [19] of the Drupal Security Team * Lee Rowlands [20] of the Drupal Security Team * Peter Wolanin [21] of the Drupal Security Team * Alex Pott [22] of the Drupal Security Team * David Snopek [23] of the Drupal Security Team * Pere Orga [24] of the Drupal Security Team * Neil Drumm [25] of the Drupal Security Team * Cash Williams [26] of the Drupal Security Team * Daniel Wehner [27] * Tim Plunkett [28] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached by email at security at drupal.org or via the contact form. Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site. [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://groups.drupal.org/security/faq-2018-002 [4] https://www.drupal.org/project/drupal/releases/7.58 [5] https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=2266d2a83db50e2f97682d… [6] https://www.drupal.org/project/drupal/releases/8.5.1 [7] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [8] https://www.drupal.org/core/release-cycle-overview [9] https://www.drupal.org/project/drupal/releases/8.3.9 [10] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [11] https://www.drupal.org/project/drupal/releases/8.4.6 [12] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [13] https://www.drupal.org/project/d6lts [14] https://www.drupal.org/u/Jasu_M [15] https://www.drupal.org/u/Jasu_M [16] https://www.drupal.org/user/2582268 [17] https://www.drupal.org/user/124982 [18] https://www.drupal.org/user/65776 [19] https://www.drupal.org/user/102818 [20] https://www.drupal.org/u/larowlan [21] https://www.drupal.org/user/49851 [22] https://www.drupal.org/u/alexpott [23] https://www.drupal.org/u/dsnopek [24] https://www.drupal.org/u/pere-orga [25] https://www.drupal.org/u/drumm [26] https://www.drupal.org/u/cashwilliams [27] https://www.drupal.org/u/dawehner [28] https://www.drupal.org/u/tim.plunkett

1 0

Drupal 7 and 8 core critical release on March 28th, 2018 PSA-2018-001
by security-news＠drupal.org 21 Mar '18

21 Mar '18

View online: https://www.drupal.org/psa-2018-001 * Advisory ID: DRUPAL-PSA-2018-001 * Project: Drupal Core * Version: 7.x, 8.x * Date: 2018-March-21 -------- DESCRIPTION --------------------------------------------------------- There will be a security release of *Drupal 7.x, 8.3.x, 8.4.x, and 8.5.x on March 28th 2018 between 18:00 - 19:30 UTC*, one week from the publication of this document, that will fix a highly critical security vulnerability. The Drupal Security Team urges you to reserve time for core updates at that time because exploits /might/ be developed within hours or days. Security release announcements will appear on the Drupal.org security advisory page [1]. While Drupal 8.3.x and 8.4.x are no longer supported and we don't normally provide security releases for unsupported minor releases [2], given the potential severity of this issue, we /are/ providing 8.3.x and 8.4.x releases that includes the fix for sites which have not yet had a chance to update to 8.5.0. The Drupal security team strongly recommends the following: * Sites on 8.3.x should immediately update to the 8.3.x release that will be provided in the advisory, and then plan to update to the latest 8.5.x security release in the next month. * Sites on 8.4.x should immediately update to the 8.4.x release that will be provided in the advisory, and then plan to update to the latest 8.5.x security release in the next month. * Sites on 7.x or 8.5.x can immediately update when the advisory is released using the normal procedure. The security advisory will list the appropriate version numbers for all three Drupal 8 branches. Your site's update report page will recommend the 8.5.x release even if you are on 8.3.x or 8.4.x, but temporarily updating to the provided backport for your site's current version will ensure you can update quickly without the possible side effects of a minor version update. The Security Team or any other party is not able to release any more information about this vulnerability until the announcement is made. The announcement will be made public at www.drupal.org/security [3], over Twitter, and in email for those who have subscribed to our email list. To subscribe to the email list: log in on drupal.org, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab. Journalists interested in covering the story are encouraged to email security-press(a)drupal.org to be sure they will get a copy of the journalist-focused release. The Security Team will release a journalist-focused summary email at the same time as the new code release and advisory. If you find a security issue, please report it at https://www.drupal.org/security-team/report-issue [4]. [1] https://www.drupal.org/security [2] https://www.drupal.org/core/release-cycle-overview [3] www.drupal.org/security [4] https://www.drupal.org/security-team/report-issue

1 0

JSON API - Moderately critical - Access Bypass - SA-CONTRIB-2018-016
by security-news＠drupal.org 21 Mar '18

21 Mar '18

View online: https://www.drupal.org/sa-contrib-2018-016 Project: JSON API [1] Version: 8.x-1.x-dev Date: 2018-March-21 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access Bypass Description: This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. The module doesn't sufficiently check access when viewing related resources or relationships, thereby causing an access bypass vulnerability. This vulnerability is mitigated by the fact that an attacker must be allowed to view the related data, otherwise all they can glean is an entity type UUID and a UUID, which are meaningless by themselves. Solution: Install the latest version: * If you use the JSON API module for Drupal 8.x, upgrade to JSON API 8.x-1.14 [3] Reported By: * Gabe Sullice [4] Fixed By: * Wim Leers [5] * Mateu Aguiló Bosch [6] Coordinated By: * Michael Hess [7] Of the Drupal Security Team [1] https://www.drupal.org/project/jsonapi [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/jsonapi/releases/8.x-1.14 [4] https://www.drupal.org/user/2287430 [5] https://www.drupal.org/user/99777 [6] https://www.drupal.org/user/550110 [7] https://www.drupal.org/u/mlhess

1 0

Exif - Critical - Access bypass - SA-CONTRIB-2018-017
by security-news＠drupal.org 21 Mar '18

21 Mar '18

View online: https://www.drupal.org/sa-contrib-2018-017 Project: Exif [1] Version: 8.x-1.x-dev Date: 2018-March-21 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables you to retrieve image metadata and use them in fields or title. The module doesn't sufficiently restrict access to module setting pages thereby causing an access bypass vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission to create entities of certain content entity types. Solution: Install the latest version: * If you use the Exif module for Drupal 8.x, upgrade to Exif 8.x-1.1 [3] Reported By: * Jean-Francois Hovinne [4] Fixed By: * jphautin [5] * Jean-Francois Hovinne [6] Coordinated By: * Damien McKenna [7] [1] https://www.drupal.org/project/exif [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/exif/releases/8.x-1.1 [4] https://www.drupal.org/user/77723 [5] https://www.drupal.org/user/534338 [6] https://www.drupal.org/user/77723 [7] https://www.drupal.org/user/108450

1 0

JSON API - Moderately critical - Multiple Vulnerabilities - SA-CONTRIB-2018-15
by security-news＠drupal.org 21 Feb '18

21 Feb '18

View online: https://www.drupal.org/sa-contrib-2018-15 Project: JSON API [1] Date: 2018-February-21 Security risk: *Moderately critical* 13∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Multiple Vulnerabilities Description: This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. * The module doesn't sufficiently associate cacheability metadata in certain situations thereby causing an access bypass vulnerability. This vulnerability is mitigated by the fact that an attacker cannot trigger an exploitable situation themselves. * The module doesn't sufficiently check access in certain situations. This vulnerability is mitigated by the fact that an attacker must have permission to create entities of certain content entity types. Solution: Install the latest version: * If you use the JSON API module for Drupal 8.x, upgrade to JSON API 8.x-1.9 [3] Reported By: * Wim Leers [4] * Gabe Sullice [5] * Aaron Clemmer [6] Fixed By: * Wim Leers [7] * Mateu Aguiló Bosch [8] * Gabe Sullice [9] Coordinated By: * Michael Hess [10] of the Drupal Security Team [1] https://www.drupal.org/project/jsonapi [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/jsonapi/releases/8.x-1.9 [4] https://www.drupal.org/user/99777 [5] https://www.drupal.org/user/2287430 [6] https://www.drupal.org/u/acamer32 [7] https://www.drupal.org/user/99777 [8] https://www.drupal.org/user/550110 [9] https://www.drupal.org/user/2287430 [10] https://www.drupal.org/u/mlhess

1 0

CKEditor Upload Image - Critical - Access bypass - SA-CONTRIB-2018-014
by security-news＠drupal.org 21 Feb '18

21 Feb '18

View online: https://www.drupal.org/sa-contrib-2018-014 Project: CKEditor Upload Image [1] Date: 2018-February-21 Security risk: *Critical* 15∕25 AC:None/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables you to drag and drop or paste images into CKEditor. The module does not sufficiently verify users permissions, which leads to anonymous users being able to upload files to the server. Solution: Install the latest version: * If you use the CKEditor Upload Image module for Drupal 8.x, upgrade to CKEditor Upload Image 8.x-1.5 [3] Reported By: * Jean-Francois Hovinne [4] Fixed By: * Jean-Francois Hovinne [5] * Mer [6] * Greg Knaddison [7] of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/ckeditor_uploadimage [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ckeditor_uploadimage/releases/8.x-1.5 [4] https://www.drupal.org/user/77723 [5] https://www.drupal.org/user/77723 [6] https://www.drupal.org/user/3513520 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/36762

1 0

Drupal core - Critical - Multiple Vulnerabilities - SA-CORE-2018-001
by security-news＠drupal.org 21 Feb '18

21 Feb '18

View online: https://www.drupal.org/sa-core-2018-001 Project: Drupal core [1] Version: 8.4.x-dev7.x-dev Date: 2018-February-21 Security risk: *Critical* 16∕25 AC:Basic/A:User/CI:Some/II:Some/E:Exploit/TD:Default [2] Vulnerability: Multiple Vulnerabilities Description: .. Comment reply form allows access to restricted content - Critical - Drupal 8 Users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments. .. JavaScript cross-site scripting prevention is incomplete - Critical - Drupal 7 and Drupal 8 Drupal has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML. This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected. .. Private file access bypass - Moderately Critical - Drupal 7 When using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another is trying to deny it, leading to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs for unusual site configurations. .. jQuery vulnerability with untrusted domains - Moderately Critical - Drupal A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 as a side effect of upgrading Drupal core to use a newer version of jQuery. For Drupal 7, it is fixed in the current release (Drupal 7.57) for jQuery 1.4.4 (the version that ships with Drupal 7 core) as well as for other newer versions of jQuery that might be used on the site, for example using the jQuery Update module [3]. .. Language fallback can be incorrect on multilingual sites with node access restrictions - Moderately Critical - Drupal 8 When using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_records(). /Note that the update will mark the node access tables as needing a rebuild, which will take a long time on sites with a large number of nodes./ .. Settings Tray access bypass - Moderately Critical - Drupal 8 The Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the only two implementations in core, but does not harden against other such bypasses. This vulnerability can be mitigated by disabling the Settings Tray module. .. External link injection on 404 pages when linking to the current page - Less Critical - Drupal 7 Drupal core has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an external site. Solution: Install the latest version: * If you are using Drupal 8 , upgrade to Drupal 8.4.5 [4] * If you are using Drupal 7 , upgrade to Drupal 7.57 [5] Reported By: * .. Comment reply form allows access to restricted content - Critical - Drupal 8 * Ivan [6] * .. JavaScript cross-site scripting prevention is incomplete - Critical - Drupal 7 and Drupal 8) * Grant Gaudet [7] * .. Private file access bypass - Moderately Critical - Drupal 7 * Anders Olsson [8] * .. jQuery vulnerability with untrusted domains - Moderately Critical - Drupal 7 * will c [9] * .. Language fallback can be incorrect on multilingual sites with node access restrictions - Moderately Critical - Drupal 8 * Ken Rickard [10] * .. Settings Tray access bypass - Moderately Critical - Drupal 8 * Ted Bowman [11] * .. External link injection on 404 pages when linking to the current page - Less Critical - Drupal 7 * David Rothstein [12] of the Drupal Security Team Fixed By: * .. Comment reply form allows access to restricted content - Critical - Drupal 8 * Ivan [13] * Lee Rowlands [14] of the Drupal Security Team * David Rothstein [15] of the Drupal Security Team * Nathaniel Catchpole [16] of the Drupal Security Team * Jess [17] of the Drupal Security Team * Wim Leers [18] * Ted Bowman [19] * Matthew Donadio [20] * Tim Plunkett [21] * Peter Wolanin [22] of the Drupal Security Team * .. JavaScript cross-site scripting prevention is incomplete - Critical - Drupal 7 and Drupal 8) * Grant Gaudet [23] * Kay Leung [24] * Heine Deelstra [25] of the Drupal Security Team * Peter Wolanin [26] of the Drupal Security Team * David Rothstein [27] of the Drupal Security Team * Jess [28] of the Drupal Security Team * Cash Williams [29] of the Drupal Security Team * Matthew Grill [30] * Fatima Sarah Khalid [31] * .. Private file access bypass - Moderately Critical - Drupal 7 * David Rothstein [32] of the Drupal Security Team * Lee Rowlands [33] of the Drupal Security Team * Jess [34] of the Drupal Security Team * Stefan Ruijsenaars [35] of the Drupal Security Team * Ken Rickard [36] * .. jQuery vulnerability with untrusted domains - Moderately Critical - Drupal 7 * Chris McCafferty [37] of the Drupal Security Team * Matthew Grill [38] * will c [39] * David Rothstein [40] of the Drupal Security Team * Greg Knaddison [41] of the Drupal Security Team * Jess [42] of the Drupal Security Team * Alex Bronstein [43] of the Drupal Security Team * .. Language fallback can be incorrect on multilingual sites with node access restrictions - Moderately Critical - Drupal 8 * Francesco Placella [44] * Gábor Hojtsy [45] * Michael Schmid [46] * Ken Rickard [47] * Tobias Zimmermann [48] * Jess [49] of the Drupal Security Team * Sascha Grossenbacher [50] * .. Settings Tray access bypass - Moderately Critical - Drupal 8 * Ted Bowman [51] * Lee Rowlands [52] of the Drupal Security Team * Wim Leers [53] * Jess [54] of the Drupal Security Team * Samuel Mortenson [55] * Daniel Wehner [56] * David Rothstein [57] of the Drupal Security Team * .. External link injection on 404 pages when linking to the current page - Less Critical - Drupal 7 * David Rothstein [58] of the Drupal Security Team * Samuel Mortenson [59] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/jquery_update [4] https://www.drupal.org/project/drupal/releases/8.4.5 [5] https://www.drupal.org/project/drupal/releases/7.57 [6] https://www.drupal.org/user/556138 [7] https://www.drupal.org/user/360002 [8] https://www.drupal.org/user/855656 [9] https://www.drupal.org/user/2610796 [10] https://www.drupal.org/user/20975 [11] https://www.drupal.org/user/240860 [12] https://www.drupal.org/user/124982 [13] https://www.drupal.org/user/556138 [14] https://www.drupal.org/user/395439 [15] https://www.drupal.org/user/124982 [16] https://www.drupal.org/user/35733 [17] https://www.drupal.org/user/65776 [18] https://www.drupal.org/user/99777 [19] https://www.drupal.org/user/240860 [20] https://www.drupal.org/user/325244 [21] https://www.drupal.org/user/241634 [22] https://www.drupal.org/user/49851 [23] https://www.drupal.org/user/360002 [24] https://www.drupal.org/user/591932 [25] https://www.drupal.org/user/17943 [26] https://www.drupal.org/user/49851 [27] https://www.drupal.org/user/124982 [28] https://www.drupal.org/user/65776 [29] https://www.drupal.org/user/421070 [30] https://www.drupal.org/user/1602706 [31] https://www.drupal.org/user/3319263 [32] https://www.drupal.org/user/124982 [33] https://www.drupal.org/user/395439 [34] https://www.drupal.org/user/65776 [35] https://www.drupal.org/user/551886 [36] https://www.drupal.org/user/20975 [37] https://www.drupal.org/user/1850070 [38] https://www.drupal.org/user/1602706 [39] https://www.drupal.org/user/2610796 [40] https://www.drupal.org/user/124982 [41] https://www.drupal.org/user/36762 [42] https://www.drupal.org/user/65776 [43] https://www.drupal.org/user/78040 [44] https://www.drupal.org/user/183211 [45] https://www.drupal.org/user/4166 [46] https://www.drupal.org/user/643820 [47] https://www.drupal.org/user/20975 [48] https://www.drupal.org/user/107158 [49] https://www.drupal.org/user/65776 [50] https://www.drupal.org/user/214652 [51] https://www.drupal.org/user/240860 [52] https://www.drupal.org/user/395439 [53] https://www.drupal.org/user/99777 [54] https://www.drupal.org/user/65776 [55] https://www.drupal.org/user/2582268 [56] https://www.drupal.org/user/99340 [57] https://www.drupal.org/user/124982 [58] https://www.drupal.org/user/124982 [59] https://www.drupal.org/user/2582268

1 0

Entity API - Moderately critical - Information Disclosure - SA-CONTRIB-2018-013
by security-news＠drupal.org 14 Feb '18

14 Feb '18

View online: https://www.drupal.org/sa-contrib-2018-013 Project: Entity API [1] Date: 2018-February-14 Security risk: *Moderately critical* 10∕25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Information Disclosure Description: The Entity API module extends the entity API of Drupal core in order to provide a unified way to deal with entities and their properties. The module prints debugging information to the HTML output in certain error conditions thereby causing an information disclosure vulnerability. This vulnerability is mitigated by the fact that an attacker needs to be able to trigger the error condition in a way that protected data is exposed. Solution: Install the latest version: * If you use the Entity API module for Drupal 7.x, upgrade to Entity API 7.x-1.9 [3] Reported By: * Klaus Purer [4] Fixed By: * Klaus Purer [5] * Dick Olsson [6] * Wolfgang Ziegler [7] Coordinated By: * Michael Hess [8] of the Drupal Security Team [1] https://www.drupal.org/project/entity [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity/releases/7.x-1.9 [4] https://www.drupal.org/user/262198 [5] https://www.drupal.org/user/262198 [6] https://www.drupal.org/user/239911 [7] https://www.drupal.org/user/16747 [8] https://www.drupal.org/u/mlhess

1 0

Entity Backup - Critical - Module Unsupported - SA-CONTRIB-2018-012
by security-news＠drupal.org 14 Feb '18

14 Feb '18

View online: https://www.drupal.org/sa-contrib-2018-012 Project: Entity Backup [1] Date: 2018-February-14 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Module Unsupported Description: The main purpose of the Entity Backup module is to keep a backup of deleted Drupal core entities and perform recovery of them. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3] Solution: Uninstall the module Reported By: Jean-Francois Hovinne [4] Fixed By: N/A Coordinated By: N/A [1] https://www.drupal.org/project/entity_backup [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/jfhovinne

1 0