View online: https://www.drupal.org/sa-contrib-2023-046

Project: Entity cache [1] Date: 2023-September-27 Security risk: *Critical* 16∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure

Description:  Entity Cache puts core entities into Drupal's cache API.

A recent release of the module does not sanitize certain inputs appropriately. This can lead to unintended behavior when wildcard characters are included in the input.

The impact of this bug should be relatively minor in most configurations, but in worst-case scenarios it could lead to significant Access Bypass.

Solution:  Install the latest version:

* If you use the Entity cache module for Drupal 7.x, upgrade to Entity cache 7.x-1.7 [3].

Reported By:  * Gary Sargent [4]

Fixed By:  * Damien McKenna [5] of the Drupal Security Team * Gary Sargent [6] * Drew Webber [7] of the Drupal Security Team * Jess [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team * Juraj Nemec [10] of the Drupal Security Team * Linus Cash [11] * Neil Hodgkinson [12]

Coordinated By:  * Damien McKenna [13] of the Drupal Security Team * Drew Webber [14] of the Drupal Security Team * Jess [15] of the Drupal Security Team * Greg Knaddison [16] of the Drupal Security Team

[1] https://www.drupal.org/project/entitycache [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entitycache/releases/7.x-1.7 [4] https://www.drupal.org/user/3783192 [5] https://www.drupal.org/user/108450 [6] https://www.drupal.org/user/3783192 [7] https://www.drupal.org/user/255969 [8] https://www.drupal.org/user/65776 [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/272316 [11] https://www.drupal.org/user/3783315 [12] https://www.drupal.org/user/3783314 [13] https://www.drupal.org/user/108450 [14] https://www.drupal.org/user/255969 [15] https://www.drupal.org/user/65776 [16] https://www.drupal.org/user/36762