- Security-news - lists.drupal.org

shib_auth Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-043
by security-news＠drupal.org 03 May '17

03 May '17

View online: https://www.drupal.org/node/2875366 * Advisory ID: DRUPAL-SA-CONTRIB-2017-043 * Project: Shibboleth authentication [1] (third-party module) * Version: 7.x * Date: 2017-May-03 * Security risk: 13/25 ( Moderately Critical) AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] * Vulnerability: Access bypass, Information Disclosure -------- DESCRIPTION --------------------------------------------------------- This module enables you to login via Shibboleth. The module doesn't sufficiently logout the user when the shib session expires, which depending on the caching mechanism makes private data public. This vulnerability is mitigated by the fact that shib_auth would have to be used in combination with a caching mechanism which caches content for authenticated users. -------- VERSIONS AFFECTED --------------------------------------------------- * 7.x-4.x versions prior to 7.x-4.4. Drupal core is not affected. If you do not use the contributed Shibboleth authentication [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the shib_auth module for Drupal 7.x, upgrade to shib_auth 7.x-4.4 [4] Also see the Shibboleth authentication [5] project page. -------- REPORTED BY --------------------------------------------------------- * Bart Vanderstukken [6] -------- FIXED BY ------------------------------------------------------------ * Kristof Bajnok [7] The module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [13] [1] https://www.drupal.org/project/shib_auth [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/shib_auth [4] https://www.drupal.org/project/shib_auth/releases/7.x-4.4 [5] https://www.drupal.org/project/shib_auth [6] https://www.drupal.org/u/sneakyvv [7] https://www.drupal.org/u/bajnokk [8] https://www.drupal.org/u/mlhess [9] https://www.drupal.org/contact [10] https://www.drupal.org/security-team [11] https://www.drupal.org/writing-secure-code [12] https://www.drupal.org/security/secure-configuration [13] https://twitter.com/drupalsecurity

1 0

Drupal Core - Critical - Access Bypass - SA-CORE-2017-002
by security-news＠drupal.org 19 Apr '17

19 Apr '17

View online: https://www.drupal.org/SA-CORE-2017-002 * Advisory ID: DRUPAL-SA-CORE-2017-002 * Project: Drupal core [1] * Version: 8.x * Date: 2017-April-19 * CVEID: CVE-2017-6919 * Security risk: 17/25 ( Critical) AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This is a critical access bypass vulnerability. A site is only affected by this is the following conditions are met: * The site has the RESTful Web Services (rest) module enabled. * The site allows PATCH requests. * An attacker can get or register a user account on the site. While we don't normally provide security releases for unsupported minor releases [3], given the potential severity of this issue, we have also provided an 8.2.x release to ensure that sites that have not had a chance to update to 8.3.0 can update safely. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal 8 prior to 8.2.8 and 8.3.1. * Drupal 7.x is not affected. -------- SOLUTION ------------------------------------------------------------ * If the site is running Drupal 8.2.7 or earlier, upgrade to 8.2.8. [5] * If the site is running Drupal 8.3.0, upgrade to 8.3.1. [6] Also see the Drupal core [7] project page. -------- REPORTED BY --------------------------------------------------------- * Samuel Mortenson [8] -------- FIXED BY ------------------------------------------------------------ * Alex Pott [9] of the Drupal Security Team * xjm [10] of the Drupal Security Team * Lee Rowlands [11] of the Drupal Security Team * Wim Leers [12] * Sascha Grossenbacher [13] * Daniel Wehner [14] * Tobias Stöckler [15] * Nathaniel Catchpole [16] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * The Drupal Security team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [17]. Learn more about the Drupal Security team and their policies [18], writing secure code for Drupal [19], and securing your site [20]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [21] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/core/release-cycle-overview [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/drupal/releases/8.2.8 [6] https://www.drupal.org/project/drupal/releases/8.3.1 [7] https://www.drupal.org/project/drupal [8] https://www.drupal.org/u/samuelmortenson [9] https://www.drupal.org/u/alexpott [10] https://www.drupal.org/u/xjm [11] https://www.drupal.org/u/larowlan [12] https://www.drupal.org/u/wim-leers [13] https://www.drupal.org/u/Berdir [14] https://www.drupal.org/u/dawehner [15] https://www.drupal.org/u/tstoeckler [16] https://www.drupal.org/u/catch [17] https://www.drupal.org/contact [18] https://www.drupal.org/security-team [19] https://www.drupal.org/writing-secure-code [20] https://www.drupal.org/security/secure-configuration [21] https://twitter.com/drupalsecurity

1 0

Drupal 8 core upcoming critical release PSA-2017-001
by security-news＠drupal.org 17 Apr '17

17 Apr '17

View online: https://www.drupal.org/psa-2017-001 * Advisory ID: DRUPAL-PSA-2017-001 * Project: Drupal core * Version: 8.x * Date: 2017-Apr-17 -------- DESCRIPTION --------------------------------------------------------- There will be a security release of Drupal 8.3.x and 8.2.x on *April 19th 2017 between 17:00 - 18:00 UTC* that will fix a critical vulnerability. While we don't normally provide security releases for unsupported minor releases [1], given the potential severity, the 8.2.x release includes the fix for sites which have not had a chance to update to 8.3.0. The Drupal Security Team urges you to reserve time for core updates at that time because exploits are expected to be developed within hours or days. Security release announcements will appear at the standard announcement locations [2]. This vulnerability does not affect all Drupal 8 sites; it only affects sites with certain configurations. It requires authenticated user access to exploit. The security release announcement made on April 19th 2017, will make it clear which configurations are affected. If this vulnerability affects your site, you will need to update. Please set aside time on Wednesday to look into this update. Neither the Security Team, nor Security Team members, nor any Drupal-related company are able to release any more information about this vulnerability until the announcement is made in accordance with our security policies [3] and responsible disclosure best practices [4]. .... Drupal 7 core is not affected by this issue. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at Drupal.org or via the contact form at https://www.drupal.org/contact [5]. Learn more about the Drupal Security team and their policies [6], writing secure code for Drupal [7], and securing your site [8]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [9]. [1] https://www.drupal.org/core/release-cycle-overview [2] https://www.drupal.org/security [3] https://www.drupal.org/drupal-security-team/security-team-procedures/drupal… [4] https://en.wikipedia.org/wiki/Responsible_disclosure [5] https://www.drupal.org/contact [6] https://www.drupal.org/security-team [7] https://www.drupal.org/writing-secure-code [8] https://www.drupal.org/security/secure-configuration [9] https://twitter.com/drupalsecurity

1 0

Media - Critical - 1.x branch unsupported - SA-CONTRIB-2017-042
by security-news＠drupal.org 12 Apr '17

12 Apr '17

View online: https://www.drupal.org/node/2869190 * Advisory ID: DRUPAL-SA-CONTRIB-2017-042 * Project: Media [1] (third-party module) * Date: 12-Apr-2017 -------- DESCRIPTION --------------------------------------------------------- The Media module provides an extensible framework for managing files and multimedia assets, regardless of whether they are hosted on your own site or a 3rd party site - it is commonly referred to as a 'file browser to the internet'. -------- VERSIONS AFFECTED --------------------------------------------------- * Only the 1.x branch is affected. The 2.x branch does not have this vulnerability. /li> Drupal core is not affected. If you do not use the contributed Media [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the Media 1.x branch you should upgrade to the 2.x branch. Also see the Media [3] project page. -------- REPORTED BY --------------------------------------------------------- * Fabricio Bedoya [4] -------- FIXED BY ------------------------------------------------------------ Not applicable -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [5]. Learn more about the Drupal Security team and their policies [6], writing secure code for Drupal [7], and securing your site [8]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [9] [1] https://www.drupal.org/project/media [2] https://www.drupal.org/project/media [3] https://www.drupal.org/project/media [4] https://www.drupal.org/u/fafabedoya [5] https://www.drupal.org/contact [6] https://www.drupal.org/security-team [7] https://www.drupal.org/writing-secure-code [8] https://www.drupal.org/security/secure-configuration [9] https://twitter.com/drupalsecurity

1 0

Open Atrium - Moderately critical - Information Disclosure - SA-CONTRIB-2014-041
by security-news＠drupal.org 12 Apr '17

12 Apr '17

View online: https://www.drupal.org/node/2869156 * Advisory ID: DRUPAL-SA-CONTRIB-2014-041 * Project: Open Atrium Core [1] (third-party module), OA Comment [2] (third-party module) * Version: 7.x * Date: 2017-April-12 * Security risk: 11/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [3] * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- Open Atrium is a distribution the enables collaboration sites to be built. It contains several custom modules to provide various functionality. While content is often protected behind private groups, public content can also be shared. When using Open Atrium as an internal Intranet, this "public" content might be restricted to only logged in users by disabling anonymous access to the site. The oa_core and oa_comment modules do not properly respect the "view published content" permission and allows anonymous users to view this "public" content regardless of the permission setting. This only affects sites that have disabled the "view published content" permission for anonymous users, and only affects a small number of views. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Open Atrium distribution 7.x-2.x versions prior to 7.x-2.615 * oa_core 7.x-2.x versions prior to 7.x-2.84. * oa_comment 7.x-2.x versions prior to 7.x-2.14. Drupal core is not affected. If you do not use the contributed Open Atrium Core [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version of Open Atrium. Be sure to revert the following features: oa_comments, oa_core, oa_news, oa_river, oa_section, oa_sections Also see the Open Atrium [6] project page. -------- REPORTED BY --------------------------------------------------------- * Mike Potter [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Mike Potter [8] the distribution maintainer and member of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Mike Potter [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/oa_core [2] https://www.drupal.org/project/oa_comment [3] https://www.drupal.org/security-team/risk-levels [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/oa_core [6] https://www.drupal.org/project/openatrium [7] https://www.drupal.org/u/mpotter [8] https://www.drupal.org/u/mpotter [9] https://www.drupal.org/u/mpotter [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

@Base - Critical - Unsupported - SA-CONTRIB-2017-040
by security-news＠drupal.org 12 Apr '17

12 Apr '17

View online: https://www.drupal.org/node/2869148 * Advisory ID: DRUPAL-SA-CONTRIB-2017-040 * Project: @Base [1] (third-party module) * Date: 2017-April-12 -------- DESCRIPTION --------------------------------------------------------- Provide some more API for developer to work with Drupal 7. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [2] -------- VERSIONS AFFECTED --------------------------------------------------- * All versions. Drupal core is not affected. If you do not use the contributed @Base [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the @Base module for Drupal you should uninstall it. Also see the @Base [4] project page. -------- REPORTED BY --------------------------------------------------------- * Chad DeGroot [5] -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [6]. Learn more about the Drupal Security team and their policies [7], writing secure code for Drupal [8], and securing your site [9]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [10] [1] https://www.drupal.org/project/at_base [2] https://www.drupal.org/node/251466 [3] https://www.drupal.org/project/at_base [4] https://www.drupal.org/project/at_base [5] https://www.drupal.org/u/badjava [6] https://www.drupal.org/contact [7] https://www.drupal.org/security-team [8] https://www.drupal.org/writing-secure-code [9] https://www.drupal.org/security/secure-configuration [10] https://twitter.com/drupalsecurity

1 0

Scheduler Workbench Integration - Critical - Unsupported - SA-CONTRIB-2017-39
by security-news＠drupal.org 12 Apr '17

12 Apr '17

View online: https://www.drupal.org/node/2869141 * Advisory ID: DRUPAL-SA-CONTRIB-2017-39 * Project: Scheduler Workbench Integration [1] (third-party module) * Date: 12-Apr-2017 -------- DESCRIPTION --------------------------------------------------------- Provides integration between the Scheduler module and the Workbench Moderation module. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 -------- VERSIONS AFFECTED --------------------------------------------------- * All versions Drupal core is not affected. If you do not use the contributed Scheduler Workbench Integration [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the Scheduler Workbench Integration module for Drupal you should uninstall it. Also see the Scheduler Workbench Integration [3] project page. -------- REPORTED BY --------------------------------------------------------- * Caroline Boyden [4] -------- FIXED BY ------------------------------------------------------------ Not applicable -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [5]. Learn more about the Drupal Security team and their policies [6], writing secure code for Drupal [7], and securing your site [8]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [9] [1] https://www.drupal.org/project/scheduler_workbench [2] https://www.drupal.org/project/scheduler_workbench [3] https://www.drupal.org/project/scheduler_workbench [4] https://www.drupal.org/user/657902 [5] https://www.drupal.org/contact [6] https://www.drupal.org/security-team [7] https://www.drupal.org/writing-secure-code [8] https://www.drupal.org/security/secure-configuration [9] https://twitter.com/drupalsecurity

1 0

References - Critical - Unsupported - SA-CONTRIB-2017-38
by security-news＠drupal.org 12 Apr '17

12 Apr '17

View online: https://www.drupal.org/node/2869138 * Advisory ID: DRUPAL-SA-CONTRIB-2017-38 * Project: References [1] (third-party module) * Date: 12-Apr-2017 -------- DESCRIPTION --------------------------------------------------------- This project provides D7 versions of the 'node_reference' and 'user_reference' field types, that were part of the CCK package in D6, at functional parity with the D6 counterparts. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 -------- VERSIONS AFFECTED --------------------------------------------------- * All versions Drupal core is not affected. If you do not use the contributed References [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the References module for Drupal you should uninstall it. Also see the References [3] project page. -------- REPORTED BY --------------------------------------------------------- * Cash Williams [4] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ Not applicable -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [5]. Learn more about the Drupal Security team and their policies [6], writing secure code for Drupal [7], and securing your site [8]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [9] [1] https://www.drupal.org/project/references [2] https://www.drupal.org/project/references [3] https://www.drupal.org/project/references [4] https://www.drupal.org/user/421070 [5] https://www.drupal.org/contact [6] https://www.drupal.org/security-team [7] https://www.drupal.org/writing-secure-code [8] https://www.drupal.org/security/secure-configuration [9] https://twitter.com/drupalsecurity

1 0

Filemaker Form - Critical - Unsupported - SA-CONTRIB-2017-37
by security-news＠drupal.org 12 Apr '17

12 Apr '17

View online: https://www.drupal.org/node/2869129 * Advisory ID: DRUPAL-SA-CONTRIB-2017-37 * Project: Filemaker Form [1] (third-party module) * Date: 12-Apr-2017 -------- DESCRIPTION --------------------------------------------------------- Easily create forms in Drupal that submit data to Filemaker databases which are hosted on Filemaker Server. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 -------- VERSIONS AFFECTED --------------------------------------------------- * All versions Drupal core is not affected. If you do not use the contributed Filemaker Form [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the Filemaker Form module for Drupal you should uninstall it. Also see the Filemaker Form [3] project page. -------- REPORTED BY --------------------------------------------------------- * adlab [4] -------- FIXED BY ------------------------------------------------------------ Not applicable -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [5]. Learn more about the Drupal Security team and their policies [6], writing secure code for Drupal [7], and securing your site [8]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [9] [1] https://www.drupal.org/project/filemakerform [2] https://www.drupal.org/project/filemakerform [3] https://www.drupal.org/project/filemakerform [4] https://www.drupal.org/user/3514633 [5] https://www.drupal.org/contact [6] https://www.drupal.org/security-team [7] https://www.drupal.org/writing-secure-code [8] https://www.drupal.org/security/secure-configuration [9] https://twitter.com/drupalsecurity

1 0

Legal - Critical - Unsupported - SA-CONTRIB-2017-36
by security-news＠drupal.org 12 Apr '17

12 Apr '17

View online: https://www.drupal.org/node/2869127 * Advisory ID: DRUPAL-SA-CONTRIB-2017-36 * Project: Legal [1] (third-party module) * Date: 12-Apr-2017 -------- DESCRIPTION --------------------------------------------------------- Displays your Terms & Conditions to users who want to register, and requires that they accept the T&C before their registration is accepted. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 -------- VERSIONS AFFECTED --------------------------------------------------- * All versions Drupal core is not affected. If you do not use the contributed Legal [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the Legal module for Drupal you should uninstall it. Also see the Legal [3] project page. -------- REPORTED BY --------------------------------------------------------- * pbafe [4] -------- FIXED BY ------------------------------------------------------------ Not applicable -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [5]. Learn more about the Drupal Security team and their policies , writing secure code for Drupal [6], and securing your site [7]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [8] [1] https://www.drupal.org/project/legal [2] https://www.drupal.org/project/legal [3] https://www.drupal.org/project/legal [4] https://www.drupal.org/user/3494981 [5] https://www.drupal.org/contact [6] https://www.drupal.org/writing-secure-code [7] https://www.drupal.org/security/secure-configuration [8] https://twitter.com/drupalsecurity

1 0