From security em unicamp.br Wed Nov 6 15:35:18 2024 From: security em unicamp.br (CSIRT Unicamp) Date: Wed, 6 Nov 2024 15:35:18 -0300 Subject: [SECURITY-L] [Security-news] Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057 In-Reply-To: References: Message-ID: View online: https://www.drupal.org/sa-contrib-2024-057 Project: Basic HTTP Authentication [1] Date: 2024-November-06 Security risk: *Critical* 16 ? 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: The module provides a possibility to restrict access to specific paths using basic HTTP authentication, in addition to standard Drupal access checks. In some cases, the module removes existing access checks from some paths, resulting in an access bypass vulnerability. Solution: Install the latest version: * If you use the Basic HTTP Authentication module for Drupal 7.x, upgrade to Basic Authentication 7.x-1.4 [3] Reported By: * Roderik Muit [4] Fixed By: * Roderik Muit [5] * Ivo Van Geertruyen [6] of the Drupal Security Team Coordinated By: * Ivo Van Geertruyen [7] of the Drupal Security Team [1] https://www.drupal.org/project/basic_auth [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/basic_auth/releases/7.x-1.4 [4] https://www.drupal.org/user/8841 [5] https://www.drupal.org/user/8841 [6] https://www.drupal.org/user/383424 [7] https://www.drupal.org/user/383424 _______________________________________________ Security-news mailing list Security-news em drupal.org Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news === Computer Security Incident Response Team - CSIRT Universidade Estadual de Campinas - Unicamp Centro de Computacao - CCUEC GnuPG Public Key: http://www.security.unicamp.br/security.asc [^] Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830 -------------- Próxima Parte ---------- Um anexo em HTML foi limpo... URL: From security em unicamp.br Wed Nov 6 15:37:50 2024 From: security em unicamp.br (CSIRT Unicamp) Date: Wed, 6 Nov 2024 15:37:50 -0300 Subject: [SECURITY-L] Fwd: [Security-news] Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058 In-Reply-To: References: Message-ID: View online: https://www.drupal.org/sa-contrib-2024-058 Project: Tooltip [1] Date: 2024-November-06 Security risk: *Moderately critical* 13 ? 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <1.1.2 Description: This module enables you to add any HTML content you want in a tooltip displayed on mouse hover. The module does not sufficiently escape the markup inserted in the tooltip block. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution: Install the latest version: * If you use the Tooltip module for Drupal 8.x, 9.x or 10.x, upgrade to Tooltip 1.1.2 [3] Reported By: * Pierre Rudloff [4] Fixed By: * Matthieu Scarset [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Juraj Nemec [7] of the Drupal Security Team * Ivo Van Geertruyen [8] of the Drupal Security Team [1] https://www.drupal.org/project/tooltip [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tooltip/releases/1.1.2 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/3471281 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/272316 [8] https://www.drupal.org/u/mrbaileys _______________________________________________ Security-news mailing list Security-news em drupal.org Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news === Computer Security Incident Response Team - CSIRT Universidade Estadual de Campinas - Unicamp Centro de Computacao - CCUEC GnuPG Public Key: http://www.security.unicamp.br/security.asc [^] Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830 -------------- Próxima Parte ---------- Um anexo em HTML foi limpo... URL: From security em unicamp.br Thu Nov 21 09:29:14 2024 From: security em unicamp.br (CSIRT Unicamp) Date: Thu, 21 Nov 2024 09:29:14 -0300 Subject: [SECURITY-L] [Security-news] Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005 In-Reply-To: References: Message-ID: View online: https://www.drupal.org/sa-core-2024-005 Project: Drupal core [1] Date: 2024-November-20 Security risk: *Critical* 17 ? 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description: Drupal 7 core's Overlay module doesn't safely handle user input, leading to reflected cross-site scripting under certain circumstances. Only sites with the Overlay module enabled are affected by this vulnerability. Solution: Install the latest version: * If you are using Drupal 7, update to Drupal 7.102 [3] * Sites may also disable the Overlay module to avoid the issue. Drupal 10 and Drupal 11 are not affected, as the Overlay module was removed from Drupal core in Drupal 8. Reported By: * Cesar [4] Fixed By: * Cesar [5] * Greg Knaddison [6] of the Drupal Security Team * Matthew Grill [7] * Wim Leers [8] * Drew Webber [9] of the Drupal Security Team * Ra Mänd [10] * Fabian Franz [11] * Juraj Nemec [12] of the Drupal Security Team Coordinated By: * Juraj Nemec [13] of the Drupal Security Team * Greg Knaddison [14] of the Drupal Security Team * xjm [15] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/7.102 [4] https://www.drupal.org/user/3546810 [5] https://www.drupal.org/user/3546810 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/1602706 [8] https://www.drupal.org/user/99777 [9] https://www.drupal.org/user/255969 [10] https://www.drupal.org/user/601534 [11] https://www.drupal.org/user/693738 [12] https://www.drupal.org/user/272316 [13] https://www.drupal.org/user/272316 [14] https://www.drupal.org/user/36762 [15] https://www.drupal.org/u/xjm _______________________________________________ Security-news mailing list Security-news em drupal.org Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news === Computer Security Incident Response Team - CSIRT Universidade Estadual de Campinas - Unicamp Centro de Computacao - CCUEC GnuPG Public Key: http://www.security.unicamp.br/security.asc [^] Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830 -------------- Próxima Parte ---------- Um anexo em HTML foi limpo... URL: From security em unicamp.br Thu Nov 21 09:30:48 2024 From: security em unicamp.br (CSIRT Unicamp) Date: Thu, 21 Nov 2024 09:30:48 -0300 Subject: [SECURITY-L] [Security-news] Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004 In-Reply-To: References: Message-ID: View online: https://www.drupal.org/sa-core-2024-004 Project: Drupal core [1] Date: 2024-November-20 Security risk: *Moderately critical* 10 ? 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: >= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8 Description: Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. Solution: Install the latest version: * If you are using Drupal 10.2, update to Drupal 10.2.11. [3] * If you are using Drupal 10.3, update to Drupal 10.3.9. [4] * If you are using Drupal 11.0, update to Drupal 11.0.8. [5] * Drupal 7 is not affected. All versions of Drupal 10 prior to 10.2 are end-of-life and do not receive security coverage. (Drupal 8 [6] and Drupal 9 [7] have both reached end-of-life.) Updating Drupal will not solve potential issues with existing accounts affected by this bug. See Fixing emails that vary only by case [8] for additional guidance. Reported By: * Wayne Eaker [9] Fixed By: * Wayne Eaker [10] * cilefen [11] of the Drupal Security Team * Kristiaan Van den Eynde [12] * Drew Webber [13] of the Drupal Security Team * Lee Rowlands [14] of the Drupal Security Team Coordinated By: * Juraj Nemec [15] of the Drupal Security Team * Benji Fisher [16] of the Drupal Security Team * xjm [17] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/10.2.11 [4] https://www.drupal.org/project/drupal/releases/10.3.9 [5] https://www.drupal.org/project/drupal/releases/11.0.8 [6] https://www.drupal.org/psa-2021-06-29 [7] https://www.drupal.org/psa-2023-11-01 [8] https://www.drupal.org/node/3486109 [9] https://www.drupal.org/user/326925 [10] https://www.drupal.org/user/326925 [11] https://www.drupal.org/user/1850070 [12] https://www.drupal.org/user/1345130 [13] https://www.drupal.org/user/255969 [14] https://www.drupal.org/user/395439 [15] https://www.drupal.org/user/272316 [16] https://www.drupal.org/user/683300 [17] https://www.drupal.org/u/xjm _______________________________________________ Security-news mailing list Security-news em drupal.org Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news === Computer Security Incident Response Team - CSIRT Universidade Estadual de Campinas - Unicamp Centro de Computacao - CCUEC GnuPG Public Key: http://www.security.unicamp.br/security.asc [^] Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830 -------------- Próxima Parte ---------- Um anexo em HTML foi limpo... URL: