[Security-news] JSON:API - Highly critical - Remote code execution - SA-CONTRIB-2019-019

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2019-019

Project: JSON:API [1]
Date: 2019-February-20
Security risk: *Highly critical* 22∕25
AC:None/A:None/CI:All/II:All/E:Theoretical/TD:All [2]
Vulnerability: Remote code execution

Description: 
This resolves issues described in SA-CORE-2019-003 [3] for this module.

Solution: 
Install the latest version:

   * If you use the *2.x* version of the JSON:API module for Drupal 8.x,
     upgrade to JSON:API 8.x-2.3 [4]
   * If you use the *1.x* version of the JSON:API module for Drupal 8.x,
     upgrade to JSON:API 8.x-1.25 [5]


[1] https://www.drupal.org/project/jsonapi
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/sa-core-2019-003
[4] https://www.drupal.org/node/3034433
[5] https://www.drupal.org/node/3034431