[Security-news] Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012

[security-news at drupal.org]

View online: https://www.drupal.org/sa-core-2022-012

Project: Drupal core [1]
Date: 2022-July-20
Security risk: *Moderately critical* 13∕25
AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2]
Vulnerability: Information Disclosure

Description: 
In some situations, the Image module does not correctly check access to image
files not stored in the standard public files directory when generating
derivative images using the image styles system.

Access to a non-public file is checked only if it is stored in the "private"
file system. However, some contributed modules provide additional file
systems, or schemes, which may lead to this vulnerability.

This vulnerability is mitigated by the fact that it only applies when the
site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives']
or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The
recommended and default setting is FALSE, and Drupal core does not provide a
way to change that in the admin UI.

Some sites may require configuration changes following this security release.
Review the release notes for your Drupal version if you have issues accessing
files or image styles after updating.

Solution: 
Install the latest version:

   * If you are using Drupal 9.4, update to Drupal 9.4.3 [3].
   * If you are using Drupal 9.3, update to Drupal 9.3.19 [4].
   * If you are using Drupal 7, update to Drupal 7.91 [5].

All versions of Drupal 9 prior to 9.3.x are end-of-life and do not receive
security coverage. Note that Drupal 8 has reached its end of life [6].

Reported By: 
   * Guy Elsmore-Paddock [7]
   * Conrad Lara [8]

Fixed By: 
   * Lee Rowlands [9] of the Drupal Security Team
   * Conrad Lara [10]
   * mondrake [11]
   * Alex Bronstein [12] of the Drupal Security Team
   * Dave Reid [13] of the Drupal Security Team
   * xjm [14] of the Drupal Security Team
   * Guy Elsmore-Paddock [15]
   * Dave Long [16] Provisional Member of the Drupal Security Team
   * Lauri Eskola [17] Provisional Member of the Drupal Security Team
   * David Strauss [18] of the Drupal Security Team
   * Benji Fisher [19] Provisional Member of the Drupal Security Team
   * Alex Pott [20] of the Drupal Security Team
   * Drew Webber [21] of the Drupal Security Team
   * Fabian Franz [22]


[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/drupal/releases/9.4.3
[4] https://www.drupal.org/project/drupal/releases/9.3.19
[5] https://www.drupal.org/project/drupal/releases/7.91
[6] https://www.drupal.org/psa-2021-06-29
[7] https://www.drupal.org/user/156932
[8] https://www.drupal.org/user/1790054
[9] https://www.drupal.org/user/395439
[10] https://www.drupal.org/user/1790054
[11] https://www.drupal.org/user/1307444
[12] https://www.drupal.org/user/78040
[13] https://www.drupal.org/user/53892
[14] https://www.drupal.org/user/65776
[15] https://www.drupal.org/user/156932
[16] https://www.drupal.org/user/246492
[17] https://www.drupal.org/user/1078742
[18] https://www.drupal.org/user/93254
[19] https://www.drupal.org/user/683300
[20] https://www.drupal.org/user/157725
[21] https://www.drupal.org/user/255969
[22] https://www.drupal.org/user/693738