Biztonsági figyelmeztetések

OSF for Drupal - Less Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-014

Biztonsági figyelmeztetések (contrib) - 2017. február 8. 20.20
Description

This module enables administrators to use a user interface to create complex semantic queries that can be saved to be used in different locations of a Drupal instance that uses OSF.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • osf_querybuilder 7.x-3.3 versions prior to 7.x-3.3.

Drupal core is not affected. If you do not use the contributed OSF for Drupal module, there is nothing you need to do.

Solution

Install the latest version:

Also see the OSF for Drupal project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Acquia Content Hub - Moderately Critical - Access Bypass - SA-CONTRIB-2017-013

Biztonsági figyelmeztetések (contrib) - 2017. február 8. 19.35
Description

The Acquia Content Hub module enables the distribution and discovery of content from any source using the Acquia Content Hub service.

The module allows rendering of any arbitrary entity, without performing the appropriate access check. Users browsing to a well crafted URL could access information they may not be authorized to view.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Acquia Content Hub 8.x-1.x versions prior to 8.x-1.4.

Drupal core is not affected. If you do not use the contributed Acquia Content Hub module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Acquia Content Hub project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 8.x

Wetkit Omega - Moderately Critical - Access Bypass - SA-CONTRIB-2017-012

Biztonsági figyelmeztetések (contrib) - 2017. február 8. 18.00
Description

WetKit Omega 4.x is a modern, Sass and Compass enabled Drupal 7 theme powered by the Omega base theme.

When using the Drupal page cache, some links intended for privileged users can get cached and displayed to users who shouldn't have access to them.

This is mitigated by the fact that the unprivileged users won't be able to actually visit the links.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • wetkit_omega 7.x-1.x versions prior to 7.x-1.15.

Drupal core is not affected. If you do not use the contributed Web Experience Toolkit: Omega module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Web Experience Toolkit: Omega project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Facebook Pull - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-011

Biztonsági figyelmeztetések (contrib) - 2017. február 8. 17.45
Description

This module enables you to add integration with Facebook API.

The module doesn't sufficiently sanitize incoming data from Facebook.

This vulnerability is mitigated by the fact that an attacker must have be able to successfully pass malicious code through Facebook API or alter facebooks DNS and recreate API endpoints.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Facebook Pull versions prior to 7.x-3.1.

Drupal core is not affected. If you do not use the contributed Facebook Pull module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Facebook Pull project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Storage API stream wrappers - Moderately Critical - Access bypass - SA-CONTRIB-2017-010

Biztonsági figyelmeztetések (contrib) - 2017. február 8. 17.27
Description

This module provides stream wrappers to integrate Storage API with Drupal, as an alternative to Storage API's core_bridge submodule.

It provides two stream wrappers: "Storage API Public" and "Storage API Private".

The private storage API doesn't sufficiently performs access control allowing anonymous users to access the private storage files.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Storage API stream wrappers 7.x-1.x versions prior to 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Storage API stream wrappers module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Storage API stream wrappers project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Better Exposed Filters - Less Critical - Cross Site Sscripting (XSS) - SA-CONTRIB-2017-009

Biztonsági figyelmeztetések (contrib) - 2017. február 1. 16.50
Description

The Better Exposed Filters module gives site builders more choices for rendering Views' exposed form elements.

The module does not sufficiently sanitize taxonomy term descriptions when the "Include the term description" option is selected.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer taxonomy".

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Better Exposed Filters 7.x-3.x versions prior to 7.x-3.4.

Drupal core is not affected. If you do not use the contributed Better Exposed Filters module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Better Exposed Filters project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

SalesCloud - Critical - Unsupported - SA-CONTRIB-2017-008

Biztonsági figyelmeztetések (contrib) - 2017. január 25. 19.21
Description

This module Connects Drupal to SalesCloud's API, a Commerce Platform as a Service.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • All versions

Drupal core is not affected. If you do not use the contributed salescloud module, there is nothing you need to do.

Solution

If you use the salescloud module for Drupal 7.x you should uninstall it.

Also see the salescloud project page.

Reported by Fixed by

Not applicable

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Microblog - Critical - Unsupported - SA-CONTRIB-2017-007

Biztonsági figyelmeztetések (contrib) - 2017. január 25. 19.18
Description

This module enables microblogging on Drupal sites using it.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • All versions

Drupal core is not affected. If you do not use the contributed microblog module, there is nothing you need to do.

Solution

If you use the microblog module for Drupal 7.x you should uninstall it.

Also see the microblog project page.

Reported by Fixed by

Not applicable

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Oauth - Critical - Unsupported - SA-CONTRIB-2017-006

Biztonsági figyelmeztetések (contrib) - 2017. január 25. 19.14
Description

This module implements the OAuth 1.0 standard for use with Drupal and acts as a support module for other modules that wish to use OAuth.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • All versions

Drupal core is not affected. If you do not use the contributed Oauth module, there is nothing you need to do.

Solution

If you use the oauth module for Drupal 7.x you should uninstall it.

Also see the oauth project page.

Reported by Fixed by

Not applicable

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Mailjet - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2017-005

Biztonsági figyelmeztetések (contrib) - 2017. január 11. 17.25
Description

The Mailjet module integrates with a 3rd party system to deliver site-generated emails, including newsletters, system notifications, etc.

The Mailjet module included v5.2.8 of the PHPMailer library in its "includes" directory. Per PSA-2016-004, this version of the PHPMailer library was vulnerable to PHP code execution.

Per Drupal.org policy, 3rd party code should not be stored in drupal.org repositories.

Updating this module will require manual actions to replace the PHPMailer library as described in the README.txt file included in the release.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Mailjet 7.x-2.x versions prior 7.x-2.9.

Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the Mailjet module for Drupal 7.x, upgrade to Mailjet7.x-2.9

Also see the project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

OpenLucius - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-004

Biztonsági figyelmeztetések (contrib) - 2017. január 11. 17.23
Description

OpenLucius is a work management platform for social communication, documentation, and projects.

The distribution doesn't sufficiently use tokens when marking messages for users as read thereby exposing a Cross Site Request Forgery (CSRF) vulnerability.

The distribution does not sufficiently filter taxonomy term names before outputting them to HTML thereby exposing a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have permissions to insert malicious taxonomy terms.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Openlucius 7.x-1.x versions prior to 7.x-1.6.

Drupal core is not affected. If you do not use the contributed OpenLucius News module, there is nothing you need to do.

Solution

Install the latest version:

Also see the OpenLucius News project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Autocomplete Deluxe - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-003

Biztonsági figyelmeztetések (contrib) - 2017. január 11. 16.42
Description

This module creates a new widget for taxonomy fields based on JQuery UI autocomplete.

The module doesn't sufficiently escape the entered taxonomy terms thereby exposing a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have the permission to edit a taxonomy field.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Autocomplete Deluxe 7.x-2.x versions prior to 7.x-2.2.

Drupal core is not affected. If you do not use the contributed Autocomplete Deluxe module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Autocomplete Deluxe project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Doubleclick for Publishers (DFP) - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-002

Biztonsági figyelmeztetések (contrib) - 2017. január 4. 20.25
Description

This module enables you to to place advertisements on your site that are served by Google's DFP (Doubleclick for Publisher) service.

The module has multiple Cross Site Scripting (XSS) vulnerabilities due to not sufficiently escaped fields.

The "administer DFP" permission is not marked as restricted.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • DFP 7.x-1.x versions prior to 7.x-1.5.

Drupal core is not affected. If you do not use the contributed Doubleclick for Publishers (DFP) module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Doubleclick for Publishers (DFP) project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Permissions by Term -- Critical - Multiple vulnerabilities - SA-CONTRIB-2017-001

Biztonsági figyelmeztetések (contrib) - 2017. január 4. 19.07
Description

The Permissions by Term module extends Drupal functionality by restricting access to single nodes via taxonomy terms. Taxonomy terms are part of the Drupal core functionality. Taxonomy term permissions can be coupled to specific user accounts and/or user roles.

Enabling the module unintentionally gives access to all unpublished nodes to anonymous users

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Permissions by Term 8.x-1.x versions prior to 8.x-1.11.

Drupal core is not affected. If you do not use the contributed Permissions by Term module, there is nothing you need to do.

Solution

If you use the Permissions by Term module for Drupal 8.x, upgrade to Permissions by Term 8.x-1.11.

Also see the Permissions by Term project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

High-performance JavaScript callback handler - Highly Critical - Multiple vulnerabilities - SA-CONTRIB-2016-063

Biztonsági figyelmeztetések (contrib) - 2016. december 7. 18.57
Description

The High-performance JavaScript callback handler module is a light weight callback to bypass most, if not all, of Drupal's bootstrapping process to achieve improved performance.

The module does not sufficiently check whether or not a callback is being properly accessed or filtering for potential XSS or CSRF exploits.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • High-performance JavaScript callback handler (js) 7.x-1.x versions prior to 7.x-2.1.

Drupal core is not affected. If you do not use the contributed High-performance JavaScript callback handler module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the js module for Drupal 7.x, upgrade to js 7.x-2.1

Note: this upgrade is not backwards compatible with 7.x-1.x. Existing contrib and custom module implementations of this API will either need to be upgraded, replaced or removed.

Also see the High-performance JavaScript callback handler project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity