Drupal

Project: Drupal coreDate: 2020-June-17Security risk: Less critical 8∕25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassCVE IDs: CVE-2020-13665 Description: 

JSON:API PATCH requests may bypass validation for certain fields.

By default, JSON:API works in a read-only mode which makes it impossible to exploit the vulnerability. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable.

Solution: 

Install the latest version:

• If you are using Drupal 8.8.x, upgrade to Drupal 8.8.8.
• If you are using Drupal 8.9.x, upgrade to Drupal 8.9.1.
• If you are using Drupal 9.0.x, upgrade to Drupal 9.0.1.

Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.8.

Reported By: 

• Sergii Bondarenko

Fixed By: 

• Sergii Bondarenko
• Wim Leers
• Jess of the Drupal Security Team
• Lee Rowlands of the Drupal Security Team

Project: Drupal coreDate: 2020-June-17Security risk: Critical 17∕25 AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Arbitrary PHP code executionCVE IDs: CVE-2020-13664Description: 

Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances.

An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability.

Windows servers are most likely to be affected.

Solution: 

Install the latest version:

• If you are using Drupal 8.8.x, upgrade to Drupal 8.8.8.
• If you are using Drupal 8.9.x, upgrade to Drupal 8.9.1.
• If you are using Drupal 9.0.x, upgrade to Drupal 9.0.1.

Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.8.

Reported By: 

• Lorenzo G
• Sam Thomas

Fixed By: 

• Jess of the Drupal Security Team
• Samuel Mortenson of the Drupal Security Team
• Peter Wolanin of the Drupal Security Team
• Lorenzo G
• Lee Rowlands of the Drupal Security Team
• Greg Knaddison of the Drupal Security Team
• Cash Williams of the Drupal Security Team
• Heine of the Drupal Security Team
• Drew Webber of the Drupal Security Team
• Alex Pott of the Drupal Security Team
• Gábor Hojtsy

Project: Drupal coreDate: 2020-June-17Security risk: Critical 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13663Description: 

The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.

Solution: 

• If you are using Drupal 7.x, upgrade to Drupal 7.72.
• If you are using Drupal 8.8.x, upgrade to Drupal 8.8.8.
• If you are using Drupal 8.9.x, upgrade to Drupal 8.9.1.
• If you are using Drupal 9.0.x, upgrade to Drupal 9.0.1.

Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.8.

Reported By: 

• Samuel Mortenson of the Drupal Security Team
• Dor Tumarkin

Fixed By: 

• Greg Knaddison of the Drupal Security Team
• Samuel Mortenson of the Drupal Security Team
• Jess of the Drupal Security Team
• Lee Rowlands of the Drupal Security Team
• Angie Byron of the Drupal Security Team
• Peter Wolanin of the Drupal Security Team
• Daniel Wehner
• Dor Tumarkin
• Drew Webber of the Drupal Security Team
• Alex Pott of the Drupal Security Team
• David Snopek of the Drupal Security Team
• Brandon Bergren

Project: Drupal coreDate: 2020-May-20Security risk: Moderately critical 10∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Open RedirectCVE IDs: CVE-2020-13662 Description: 

Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.

The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function.

Other versions of Drupal core are not vulnerable.

Solution: 

Install the latest version:

• If you use Drupal 7.x upgrade to Drupal 7.70

Reported By: 

• vortfu

Fixed By: 

• Drew Webber of the Drupal Security Team
• Fabian Franz
• David Snopek of the Drupal Security Team
• vortfu

Project: Drupal coreDate: 2020-May-20Security risk: Moderately critical 10∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross Site ScriptingDescription: 

The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are

[...] security issues in jQuery’s DOM manipulation methods, as in .html(), .append(), and the others. Security advisories for both of these issues have been published on GitHub.

Those advisories are:

• CVE-2020-11022
• CVE-2020-11023

These vulnerabilities may be exploitable on some Drupal sites. This Drupal security release backports the fixes to the relevant jQuery functions, without making any other changes to the jQuery version that is included in Drupal core or running on the site via some other module such as jQuery Update. It is not necessary to update jquery_update on Drupal 7 sites that have the module installed.

Backwards-compatibility code has also been added to minimize regressions to Drupal sites that might rely on jQuery's prior behavior. With jQuery 3.5, incorrect self-closing HTML tags in JavaScript for elements where end tags are normally required will encounter a change in what jQuery returns or inserts. To minimize that disruption in 8.8.x and earlier, this security release retains jQuery's prior behavior for most safe tags. There may still be regressions for edge cases, including invalidly self-closed custom elements on Internet Explorer.

(Note: the backwards compatibility layer will not be included in the upcoming Drupal 8.9 and 9.0 releases, so Drupal 8 and 9 modules, themes, and sites should correct tags in JavaScript to properly use closing tags.)

If you find a regression caused by the jQuery changes, please report it in Drupal core's issue queue (or that of the relevant contrib project). However, if you believe you have found a security issue, please report it privately to the Drupal Security Team.

Solution: 

Install the latest version:

• If you are using Drupal 8.8, upgrade to Drupal 8.8.6.
• If you are using Drupal 8.7, upgrade to Drupal 8.7.14.
• If you are using Drupal 7, upgrade to Drupal 7.70.

Versions of Drupal 8 prior to 8.7 are end-of-life and do not receive security coverage. Sites on 8.6 or earlier should update to 8.7.14.

The pre-release Drupal versions (8.9 and 9.0) have been updated jQuery to version 3.5.1 as of 8.9.0-beta3 and 9.0.0-beta3.

Reported By: 

• Drew Webber of the Drupal Security Team
• Emerson Jair Reis Oliveira da Silva

Fixed By: 

• Drew Webber of the Drupal Security Team
• Sally Young
• cilefen of the Drupal Security Team
• Jess of the Drupal Security Team
• Emerson Jair Reis Oliveira da Silva
• Lee Rowlands of the Drupal Security Team
• Alex Bronstein of the Drupal Security Team
• Ben Mullins
• Lauri Eskola
• Peter Weber
• Samuel Mortenson of the Drupal Security Team