[Security-news] Smartling Connector - Less critical - Multiple vulnerabilities - SA-CONTRIB-2024-053

security-news at drupal.org security-news at drupal.org
Wed Oct 23 17:00:12 UTC 2024


View online: https://www.drupal.org/sa-contrib-2024-053

Project: Smartling Connector [1]
Date: 2024-October-23
Security risk: *Less critical* 9 ∕ 25
AC:Complex/A:Admin/CI:Some/II:None/E:Theoretical/TD:All [2]
Vulnerability: Multiple vulnerabilities

Description: 
Smartling module allows you to translate content in Drupal 7 using the
Smartling Translation Management Platform.

The module includes an outdated version of the Guzzle package
(guzzlehttp/guzzle 6.3.3), which has known security vulnerabilities [3].

Solution: 
Install the latest version:

   * If you use Smartling module for Drupal 7.x-4.x, upgrade to smartling
     7.x-4.19 [4]
   * If you use Smartling module for Drupal 7.x-3.x, upgrade to smartling
     7.x-3.8 [5]

Reported By: 
   * Pierre Rudloff [6]

Fixed By: 
   * Pavel Loparev [7]

Coordinated By: 
   * Juraj Nemec [8] of the Drupal Security Team


[1] https://www.drupal.org/project/smartling
[2] https://www.drupal.org/security-team/risk-levels
[3]
https://packagist.org/packages/guzzlehttp/guzzle/advisories?version=2122956
[4] https://www.drupal.org/project/smartling/releases/7.x-4.19
[5] https://www.drupal.org/project/smartling/releases/7.x-3.8
[6] https://www.drupal.org/user/3611858
[7] https://www.drupal.org/user/3158841
[8] https://www.drupal.org/u/poker10



More information about the Security-news mailing list