[Security-news] Drupal core - Moderately critical - Cross site scripting - SA-CORE-2022-002

[security-news at drupal.org]

View online: https://www.drupal.org/sa-core-2022-002

Project: Drupal core [1]
Date: 2022-January-19
Security risk: *Moderately critical* 14∕25
AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Default [2]
Vulnerability: Cross site scripting

Description: 
jQuery UI is a third-party library used by Drupal. This library was
previously thought to be end-of-life.

Late in 2021, jQuery UI announced that they would be continuing development,
and released a jQuery UI 1.13.0 [3] version. In addition to the issue covered
by SA-CORE-20220-001 [4], further security vulnerabilities disclosed in
jQuery UI 1.13.0 may affect Drupal 7 only:

   * CVE-2021-41182: XSS in the altField option of the Datepicker widget [5]
   * CVE-2021-41183: XSS in *Text options of the Datepicker widget [6]

Furthermore, other vulnerabilities listed below were previously unaddressed
in the version of jQuery UI included in Drupal 7 or in the jQuery Update [7]
module:

   * CVE-2016-7103: XSS in closeText option of Dialog [8]
   * CVE-2010-5312: XSS in the title option of Dialog [9] (applicable only to
     the jQuery UI version included in D7 core)

It is possible that these vulnerabilities are exploitable via contributed
Drupal modules or custom code. As a precaution, this Drupal security release
applies the fix for the above cross-site scripting issues, without making
other changes to the jQuery UI version that is included in Drupal.

This advisory is not covered by Drupal Steward [10].

.... Important note regarding the jQuery Update contrib module

These backport fixes in D7 have also been tested with the version of jQuery
UI provided by the most recent releases of the jQuery Update module (jQuery
UI 1.10.2) and the fixes confirmed. Therefore, there is no accompanying
security release for jQuery Update.

However, in early 2022 the currently supported release of jQuery Update
(7.x-2.7 from 2015) will be deprecated and replaced by a new release from the
7.x-4.x branch. The stable release from that branch will then be the only
release considered by Drupal Security Team when new jQuery security issues
arise.

Please check the jQuery Update project page [11] for more details, and for
announcements when the changes are made to supported releases.

Solution: 
Install the latest version:

   * If you are using Drupal 7, update to Drupal 7.86 [12]

Reported By: 
   * Lauri Eskola [13]

Fixed By: 
   * Drew Webber [14] of the Drupal Security Team
   * Alex Bronstein [15] of the Drupal Security Team
   * Lauri Eskola [16]


[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3] https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/
[4] https://www.drupal.org/sa-core-2022-011
[5]
https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc
[6]
https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4
[7] https://www.drupal.org/project/jquery_update
[8] https://nvd.nist.gov/vuln/detail/CVE-2016-7103
[9] https://nvd.nist.gov/vuln/detail/CVE-2010-5312
[10] https://www.drupal.org/steward
[11] https://www.drupal.org/project/jquery_update
[12] https://www.drupal.org/project/drupal/releases/7.86
[13] https://www.drupal.org/user/1078742
[14] https://www.drupal.org/user/255969
[15] https://www.drupal.org/user/78040
[16] https://www.drupal.org/user/1078742