Newsfeed-Generator

Project: GroupVersion: 8.x-1.x-devDate: 2020-August-05Security risk: Moderately critical 11∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureDescription: 

The Group module enables you to hand out permissions on a smaller subset, section or community of your website.

Under very specific circumstances, where two group types support the same content, yet hand out different permissions, non-members of the first group type may use the set of permissions of the 2nd group type for the grouped content.

This vulnerability is mitigated by the fact that you must already have a rare set-up and the two group types are configured in a way where one is more permissive than the other over the same type of content.

Solution: 

Install the latest version:

• If you are using 8.x-1.0 or later, you should upgrade to 8.x-1.2.
• If you are using 8.x-1.0-rc5, that version is not affected by this issue. You can also consider upgrading to 8.x-1.2.

Reported By: 

• John Pitcairn

Fixed By: 

• Kristiaan Van den Eynde

Project: GroupVersion: 8.x-1.x-devDate: 2020-August-05Security risk: Moderately critical 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Information disclosureDescription: 

The Group module enables you to hand out permissions on a smaller subset, section or community of your website.

With the 1.1 security release, new code was introduced to ensure proper access for all entity types, but a mistake introduced unexpected access to unpublished nodes.

Solution: 

Install the latest version:

• If you are using 8.x-1.0 or later, you should upgrade to 8.x-1.2.
• If you are using 8.x-1.0-rc5, that version is not affected by this issue. You can also consider upgrading to 8.x-1.2.

Reported By: 

• Sean Blommaert
• Martijn Vermeulen

Fixed By: 

• Kristiaan Van den Eynde

Project: Hostmaster (Aegir)Version: 7.x-3.x-devDate: 2020-July-29Security risk: Moderately critical 14∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Access bypass, Arbitrary code executionDescription: 

Aegir is a powerful hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites.

Given that

• Aegir can use both Apache and Nginx Web servers,
• Apache allows configuration-writing users to escalate their privileges to the superuser root, and
• Aegir's operations are performed by the GNU/Linux user aegir,

It follows that:

• Users with access to the aegir account can escalate their privileges to root.
• Any PHP code submitted through the front-end Web UI via enabling modules (such as PHP, Views PHP, and Computed Field) could be run as root though a cron hook implementation. (Aegir runs cron through the aegir user via Drush.)

This vulnerability is mitigated by the fact that

• an attacker must have access to the aegir account, and
• the Web server must be Apache.

While it was generally assumed that aegir access should only be provided to trusted users (i.e. users who also have access to root), this wasn't explicitly stated. The documentation has since been updated.

Solution: 

If you're running Aegir and have granted untrusted users access to the aegir account,

1. revoke aegir account access for users who you would not trust with root access,
2. disable any module functionality on the hosted Drupal sites that allows PHP code to be entered on the front-end Web UI. Computed Field, for example, can still be used safely by providing code from the back-end only. (See Stop allowing PHP from being entered on the Web UI for a plan to enforce this.)

We do not recommend switching to an Nginx Web server instead of revoking access. This is because there could be as-yet-unknown privilege-escalation exploits involving Nginx (as with any other piece of software).

Switching to Nginx

While not recommended, if this is something you'd like to do in addition to making the above change, we can offer some information on how to do it.

While there may eventually be a migration path to convert existing Apache installations to Nginx, the recommended approach is currently:

1. Set up a new Aegir installation using Nginx.
2. Remotely import sites from the original Apache server.
3. Decommission the original Apache server.

Also see the Hostmaster (Aegir) project page.

Reported By: 

• Noam Rathaus

Fixed By: 

• Colan Schwartz

Coordinated By: 

• Heineof the Drupal Security Team
• Greg Knaddisonof the Drupal Security Team

Project: GroupVersion: 8.x-1.x-devDate: 2020-July-29Security risk: Critical 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Information DisclosureDescription: 

This module enables you to hand out permissions on a smaller subset, section or community of your website.

The module used to leverage the node grants system but turned it off in its recent 8.x-1.0 release in favor of a system that works for ALL entity types, not just nodes. By doing so, some regular node access checks turned from neutral into allowed because of the way the node grants system operates.

This vulnerability is mitigated by the fact that the victim must have the GroupNode plugin installed on their website and have no other hook_node_grants() implementations on their website aside from the one that was recently removed by Group. If you do not use the GroupNode plugin or still have hook_node_grants() implementing modules enabled, your site may not be affected.

Solution: 

Install the latest version:

• If you are using 8.x-1.0-rc5 that version is not affected by this issue. You can also consider upgrading to 8.x-1.1
• If you are using 8.x-1.0 you should upgrade to 8.x-1.1

Reported By: 

• Kristiaan Van den Eynde

Fixed By: 

• Kristiaan Van den Eynde

Coordinated By: 

• Greg Knaddison Of the Drupal Security Team

Start:  2020-08-26 19:00 - 22:00 Europe/Zurich Organizers:  dpacassi Event type:  User group meeting

https://www.meetup.com/Zurich-Drupal-Meetup/events/272206741/

Join us on August 26th for the Zurich Drupal Online Meetup through Google Hangouts!
We'll start the Google Hangouts call at 19:00, our agenda will start shortly after.
There will also be time to network and exchange before, between and after our agenda.
Just make sure that you have your headphones ready in order not to have any echo problems.

The Zurich Drupal Meetup is dedicated to people interested in the Content Management System & Framework: Drupal.

We welcome everyone, from beginners to Drupal experts and people who just want to find out what Drupal is all about.
Come for the code, stay for the community!

AGENDA
• Free slot for a talk. Interested? Let us know!
• Free slot for a talk. Interested? Let us know!

GOOGLE HANGOUTS LINK
The Google Hangouts link is visible to the event attendees signed up to the event on Meetup.com.

Project: Modal FormVersion: 8.x-1.x-devDate: 2020-July-22Security risk: Critical 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

The Modal form module is a toolset for quick start of using forms in modal windows.

Any form is available for view and submit when the modal_form module is installed. The only requirement is to know the form's fully-qualified class name.

Solution: 

Upgrade to modal_form-8.x-1.2.

Also see the Modal Form project page.

Reported By: 

• Dave Long

Fixed By: 

• Sergii Bondarenko

Coordinated By: 

• Greg Knaddison of the Drupal Security Team

Project: Apigee EdgeVersion: 8.x-1.x-devDate: 2020-July-22Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

The Apigee Edge module allows connecting a Drupal site to Apigee Edge in order to build a developer portal. It contains an "Apigee Edge Teams" submodule that provides shared app functionality by allowing developers to be organized into teams.

The "Apigee Edge Teams" submodule has an information disclosure vulnerability. The "Add team member" form displays an email autocomplete field which can expose the email addresses of other accounts in the system.

This vulnerability is mitigated by the fact that to have access to the form, the site must have the Apigee Edge Teams submodule enabled, and the user must have a team role that has the "Manage team members" permission. (Note that team roles and permissions are not related to Drupal core roles and permissions).

Solution: 

Install the latest version:

• If you use the apigee_edge_teams submodule for Drupal 8.x, upgrade to Apigee Edge module 8.x-1.12

Also see the Apigee Edge project page.

Reported By: 

• Arlina Espinoza Rhoton

Fixed By: 

• Arlina Espinoza Rhoton
• Chris Novak

Coordinated By: 

• Greg Knaddison of the Drupal Security Team

Project: Easy BreadcrumbVersion: 8.x-1.128.x-1.10Date: 2020-July-22Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

This module enables you to use the current URL (path alias) and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website.

The module doesn't sufficiently sanitize editor input in certain circumstances leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability requires the user have 'administer Easy Breadcrumb settings permission'.

Solution: 

Install the latest version:

• If you use the Easy Breadcrumb module for Drupal 8, upgrade to Easy Breadcrumb 8.x-1.13

Also see the Easy Breadcrumb project page.

Reported By: 

• Greg Boggs

Fixed By: 

• Greg Boggs
• Samuel Mortenson of the Drupal Security Team

Coordinated By: 

• Greg Knaddison of the Drupal Security Team

Project: RenderkitVersion: 7.x-1.x-devDate: 2020-July-01Security risk: Less critical 9∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassDescription: 

The renderkit module contains components which can transform the display of field items sent to it.

Some of these components do not respect the '#access' property on the field render element, and thus can make rendered field values visible to visitors who would otherwise not be allowed to see those field values.

This only occurs if all of the following conditions are true:

• Your site has a field where viewing access is restricted on field level, e.g. using the "Field permissions" module.
• The access-restricted field is displayed using the "Field with formatter" entity display from renderkit, in combination with one of the affected field display processor components.

Solution: 

If a site is affected there are 2 steps to fix this issue on a site:

Step 1: Install the latest version of renderkit:

• If you use the renderkit module for Drupal 7.x, upgrade to Renderkit 7.x-1.14.

Step 2: Review your custom modules.

Look for classes that implement FieldDisplayProcessorInterface.
Consider to extend the FieldDisplayProcessorBase class instead of implementing the interface.

Also see the Renderkit project page.

Reported By: 

• Andreas Hennings

Fixed By: 

• Andreas Hennings
• mibfire

Coordinated By: 

• Greg Knaddison of the Drupal Security Team

Start:  2020-07-30 18:30 - 22:30 Europe/Zurich Organizers:  dpacassi dan2k3k4 Event type:  User group meeting

https://www.meetup.com/Zurich-Drupal-Meetup/events/271602733/

Signup on the meetup.com site: www.meetup.com/Zurich-Drupal-Meetup/events/271602733/

Summer has arrived so we would like to invite you to join us for a BBQ at Amazee Labs on Thursday, 30th July 2020.

Please bring your own meat and veggies for the BBQ, also any side dishes like salads are a welcome contribution!

Non-alcoholic and alcoholic drinks, as well as salad and bread will be provided by Amazee Labs.

Evening Program:
• Continuous deployments of vegetarian and non-vegetarian food onto the grill
• Community exchange: Roundtable & happy talk

This event is all about meeting existing and new members of the local Drupal community. Everyone is welcome: Feel free to invite your friends but please make sure to sign-up so we can estimate the number of people to come!

We are looking forward to seeing you,
Dan & David with
The Zurich Drupal User Group Meetup team

Beginn:  2020-07-02 19:00 - 20:30 Europa/Berlin Organizers:  akoe cawi leymannx Stolzenhain Event type:  User group meeting

https://www.drupalcenter.de/node/60254

Das 3. Online-Drupal-Meetup Germany wird dieses Mal von der Drupal Usergroup Berlin (das sind ja wir!) präsentiert. Diesmal:

• Einführung in DrupalSpoons, mit Beispiel – Jürgen Haas
• Anonymisierung von Live-Datenbanken – Michael Böker

Teilnahmeinfos in der Ankündigung auf Drupalcenter.de

Date: 2020-June-24Description: 

Previously, Drupal 7's end-of-life was scheduled for November 2021. Given the impact of COVID-19 on budgets and businesses, we will be extending the end of life until November 28, 2022. The Drupal Security Team will continue to follow the Security Team processes for Drupal 7 core and contributed projects.

However, this means extra work from the Drupal community at large and the security team in particular to review security reports, create patches, and release security advisories for Drupal 7. This community effort will give site owners more time while budgets recover, but the organizations that sponsor security team members and the individual security team members who volunteer their time could use your support. If you can, please donate to support the end-of-life extension.

Drupal 8 will still be end-of-life on November 2, 2021, due to Symfony 3's end of life. However, since the upgrade path from Drupal 8 to Drupal 9 is much easier, we don't anticipate the same impact on end-users.

What does this mean for my Drupal 7 site?

You can continue to run the site and get security updates via the normal channels and processes. This will give you an extra year to work on converting your site to Drupal 9.

Do I need to upgrade to Drupal 8 before I upgrade to Drupal 9?

Migrating directly from Drupal 7 to Drupal 9 is supported with the core Migrate module. Read more on preparing a Drupal 7 site for Drupal 9.

How can I help?

Consider donating to support this effort. If you are a representative of a large end-user of Drupal, we'd love you to join the Drupal Association and the security team as a partner.

You can also consider getting more involved in fixing issues in the issue queue or joining the Security Team as a way to support the effort.

What about Drupal 7 Vendor Extended Support?

The extended support will now run from November 2022 until November 2025. You can read more about the Drupal 7 Vendor Extended Support program.

What about contributed projects?

The Security Team will continue to follow the Security Team processes for contributed projects. Contributed project maintainers are asked to consider supporting existing Drupal 7 releases if they are able.

Project: Drupal coreDate: 2020-June-17Security risk: Less critical 8∕25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassCVE IDs: CVE-2020-13665 Description: 

JSON:API PATCH requests may bypass validation for certain fields.

By default, JSON:API works in a read-only mode which makes it impossible to exploit the vulnerability. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable.

Solution: 

Install the latest version:

• If you are using Drupal 8.8.x, upgrade to Drupal 8.8.8.
• If you are using Drupal 8.9.x, upgrade to Drupal 8.9.1.
• If you are using Drupal 9.0.x, upgrade to Drupal 9.0.1.

Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.8.

Reported By: 

• Sergii Bondarenko

Fixed By: 

• Sergii Bondarenko
• Wim Leers
• Jess of the Drupal Security Team
• Lee Rowlands of the Drupal Security Team

Project: Drupal coreDate: 2020-June-17Security risk: Critical 17∕25 AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Arbitrary PHP code executionCVE IDs: CVE-2020-13664Description: 

Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances.

An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability.

Windows servers are most likely to be affected.

Solution: 

Install the latest version:

• If you are using Drupal 8.8.x, upgrade to Drupal 8.8.8.
• If you are using Drupal 8.9.x, upgrade to Drupal 8.9.1.
• If you are using Drupal 9.0.x, upgrade to Drupal 9.0.1.

Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.8.

Reported By: 

• Lorenzo G
• Sam Thomas

Fixed By: 

• Jess of the Drupal Security Team
• Samuel Mortenson of the Drupal Security Team
• Peter Wolanin of the Drupal Security Team
• Lorenzo G
• Lee Rowlands of the Drupal Security Team
• Greg Knaddison of the Drupal Security Team
• Cash Williams of the Drupal Security Team
• Heine of the Drupal Security Team
• Drew Webber of the Drupal Security Team
• Alex Pott of the Drupal Security Team
• Gábor Hojtsy

Project: Drupal coreDate: 2020-June-17Security risk: Critical 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13663Description: 

The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.

Solution: 

• If you are using Drupal 7.x, upgrade to Drupal 7.72.
• If you are using Drupal 8.8.x, upgrade to Drupal 8.8.8.
• If you are using Drupal 8.9.x, upgrade to Drupal 8.9.1.
• If you are using Drupal 9.0.x, upgrade to Drupal 9.0.1.

Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage. Sites on 8.7.x or earlier should update to 8.8.8.

Reported By: 

• Samuel Mortenson of the Drupal Security Team
• Dor Tumarkin

Fixed By: 

• Greg Knaddison of the Drupal Security Team
• Samuel Mortenson of the Drupal Security Team
• Jess of the Drupal Security Team
• Lee Rowlands of the Drupal Security Team
• Angie Byron of the Drupal Security Team
• Peter Wolanin of the Drupal Security Team
• Daniel Wehner
• Dor Tumarkin
• Drew Webber of the Drupal Security Team
• Alex Pott of the Drupal Security Team
• David Snopek of the Drupal Security Team
• Brandon Bergren

Project: InternationalizationVersion: 7.x-1.x-devDate: 2020-June-17Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

The Internationalization (i18n) module is a collection of modules to extend Drupal core multilingual capabilities and allows to build real life multilingual sites.

A value in the term translation module is displayed without being escaped leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit terms in " on a taxonomy vocabulary with i18n term translation enabled and the victim uses the i18n term translation page.

Solution: 

Install the latest version:

• If you use the Internationalization (i18n) module for Drupal 7.x, upgrade to i18n 7.x-1.27

Also see the Internationalization project page.

Reported By: 

• Guillaume MEMEINT

Fixed By: 

• Guillaume MEMEINT
• Peter Philipp

Coordinated By: 

• Greg Knaddison of the Drupal Security Team

Project: Open ReadSpeakerVersion: 8.x-1.x-devDate: 2020-June-10Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

This module enables you to add a configured ReadSpeaker button for text-to-speech for your site visitors.

The module doesn't sufficiently sanitize block configuration causing a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks".

Solution: 

Install the latest version:

• If you use the Open ReadSpeaker module for Drupal 8.x, upgrade to Open ReadSpeaker 8.x-1.5

Also see the Open ReadSpeaker project page.

Reported By: 

• Ide Braakman

Fixed By: 

• Sven Schüring

Coordinated By: 

• Greg Knaddison of the Drupal Security Team

Project: YubiKeyVersion: 7.x-2.x-devDate: 2020-June-10Security risk: Less critical 9∕25 AC:Complex/A:None/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This module enables you to use a Yubikey device to protect your Drupal user account. YubiKey is a secure method for logging into many websites using a cryptographically secure USB token.

The module doesn't sufficiently implement login flood control when the module is configured for YubiKey OTP only. This allows an attacker to attempt many YubiKey OTP codes. However, a brute force attack on this code is not practical in most situations given the length and randomness of the OTP codes.

Solution: 

Install the latest version:

• If you use the Yubikey module for Drupal 7.x, upgrade to Yubikey 7.x-2.3

Also see the YubiKey project page.

Reported By: 

• majorrobot

Fixed By: 

• Todd Johnson
• majorrobot
• Kurucz István

Coordinated By: 

• Greg Knaddison of the Drupal Security Team

Project: ServicesVersion: 7.x-3.x-devDate: 2020-June-03Security risk: Moderately critical 11∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This module provides a standardized solution for building API's so that external clients can communicate with Drupal.

The module's taxonomy term index resource doesn't take into consideration certain access control tags provided (but unused) by core, that certain contrib modules depend on.

This vulnerability is mitigated by the fact your site must have the taxonomy term index resource enabled, your site must have a contributed module enabled which utilizes taxonomy term access control, and an attacker must know your api endpoint's path.

Solution: 

Install the latest version:

• If you use the Services module for Drupal 7.x, upgrade to Services 7.x-3.26

Also see the Services project page.

Reported By: 

• Vadym Abramchuk

Fixed By: 

• Vadym Abramchuk
• Tyler Frankenstein

Coordinated By: 

• Greg Knaddison of the Drupal Security Team

Start:  2020-06-03 19:00 - 20:00 Europe/Vienna Organizers:  jjchinquist Grienauer criz fago Event type:  User group meeting

https://www.meetup.com/de-DE/Drupal-Austria/events/270954920/

Lets celebrate the release of Drupal 9! https://celebratedrupal.org/

Join us on June 3rd for the Drupal Austria Online Meetup (Video conference).
We start at 19:00.
Remote meeting URL: https://meet.acolono.com/drupalat (Jitsi)

---------- Talks ----------
Round-Table discussion
"Making the transition to Drupal 9"
Panel: To be announced
Moderation: Jeremy Chinquist
max. 45 minutes

Lightning talks depending on group interest. If you have a lightning talk you would like to hold, add a comment.
20 minutes

Signup on meetup.com: https://www.meetup.com/de-DE/Drupal-Austria/events/270954920/

---------- General Info ----------

Das Drupal Austria Meetup richtet sich an alle Interessierten am freien Content Management System Drupal. Egal ob AnfängerIn oder Drupal Ninja, alle sind herzlich willkommen! JedeR ist eingeladen, eine Präsentation zu einem Drupal-Thema zu halten, sei es ein aktuelles Projekt oder ein interessantes Modul.

The Drupal Austria Meetup is dedicated to people interested in the Content Management System Drupal. We welcome everybody from beginners to Drupal ninjas and would be happy to see you present a recent project of yours or talk about any other Drupal-related topic. And of course we have to celebrate!