Category Archives: Advisories

Drupal core – Less critical – Gadget chain – SA-CORE-2024-006

Read Time:1 Minute, 26 Second
Project: 
Date: 
2024-November-20
Vulnerability: 
Gadget chain
Affected versions: 
>= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8
Description: 

Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Artbitrary File Deletion. It is not directly exploitable.

This issue is mitigated by the fact that in order to be exploitable, a separate vulnerability must be present that allows an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.

To help protect against this vulnerability, types have been added to properties in some of Drupal core’s classes. If an application extends those classes, the same types may need to be specified on the subclass to avoid a TypeError.

Solution: 

Install the latest version:

If you are using Drupal 10.2, update to Drupal 10.2.11.
If you are using Drupal 10.3, update to Drupal 10.3.9.
If you are using Drupal 11.0, update to Drupal 11.0.8.
Drupal 7 is not affected.

All versions of Drupal 10 prior to 10.2 are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Reported By: 
Drew Webber of the Drupal Security Team
Fixed By: 
Drew Webber of the Drupal Security Team
Lee Rowlands of the Drupal Security Team
Coordinated By: 
Juraj Nemec of the Drupal Security Team
Benji Fisher of the Drupal Security Team
xjm of the Drupal Security Team

Read More

Drupal core – Critical – Cross Site Scripting – SA-CORE-2024-005

Read Time:50 Second
Project: 
Date: 
2024-November-20
Vulnerability: 
Cross Site Scripting
Description: 

Drupal 7 core’s Overlay module doesn’t safely handle user input, leading to reflected cross-site scripting under certain circumstances.

Only sites with the Overlay module enabled are affected by this vulnerability.

Solution: 

Install the latest version:

If you are using Drupal 7, update to Drupal 7.102
Sites may also disable the Overlay module to avoid the issue.

Drupal 10 and Drupal 11 are not affected, as the Overlay module was removed from Drupal core in Drupal 8.

Reported By: 
Fixed By: 
Cesar
Greg Knaddison of the Drupal Security Team
Matthew Grill
Wim Leers
Drew Webber of the Drupal Security Team
Ra Mänd
Fabian Franz
Juraj Nemec of the Drupal Security Team
Coordinated By: 
Juraj Nemec of the Drupal Security Team
Greg Knaddison of the Drupal Security Team
xjm of the Drupal Security Team

Read More

Drupal core – Moderately critical – Access bypass – SA-CORE-2024-004

Read Time:1 Minute, 17 Second
Project: 
Date: 
2024-November-20
Vulnerability: 
Access bypass
Affected versions: 
>= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8
Description: 

Drupal’s uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation.

As a result, a user may be able to register with the same email address as another user.

This may lead to data integrity issues.

Solution: 

Install the latest version:

If you are using Drupal 10.2, update to Drupal 10.2.11.
If you are using Drupal 10.3, update to Drupal 10.3.9.
If you are using Drupal 11.0, update to Drupal 11.0.8.
Drupal 7 is not affected.

All versions of Drupal 10 prior to 10.2 are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Updating Drupal will not solve potential issues with existing accounts affected by this bug. See Fixing emails that vary only by case for additional guidance.

Reported By: 
Fixed By: 
Wayne Eaker
cilefen of the Drupal Security Team
Kristiaan Van den Eynde
Drew Webber of the Drupal Security Team
Lee Rowlands of the Drupal Security Team
Coordinated By: 
Juraj Nemec of the Drupal Security Team
Benji Fisher of the Drupal Security Team
xjm of the Drupal Security Team

Read More

Drupal core – Moderately critical – Cross Site Scripting – SA-CORE-2024-003

Read Time:1 Minute, 3 Second
Project: 
Date: 
2024-November-20
Vulnerability: 
Cross Site Scripting
Affected versions: 
>= 8.8.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8
Description: 

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized.

Solution: 

Install the latest version:

If you are using Drupal 10.2, update to Drupal 10.2.11.
If you are using Drupal 10.3, update to Drupal 10.3.9.
If you are using Drupal 11.0, update to Drupal 11.0.8.

All versions of Drupal 10 prior to 10.2 are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Reported By: 
Fixed By: 
Lee Rowlands of the Drupal Security Team
catch of the Drupal Security Team
Mingsong
Juraj Nemec of the Drupal Security Team
Dave Long of the Drupal Security Team
Benji Fisher of the Drupal Security Team
Coordinated By: 
Juraj Nemec of the Drupal Security Team
Greg Knaddison of the Drupal Security Team

Read More

rust-rustls-0.23.17-1.el9 rust-zlib-rs-0.4.0-1.el9

Read Time:28 Second

FEDORA-EPEL-2024-3672733748

Packages in this update:

rust-rustls-0.23.17-1.el9
rust-zlib-rs-0.4.0-1.el9

Update description:

Update the rustls crate to version 0.23.17.
Update the zlib-rs crate to version 0.4.0.

The update to zlib-rs v0.4.0 also addresses CVE-2024-11249 (stack overflow during decompression with malicious input). This issue had no actual impact in Fedora, because no applications yet use the the zlib-rs feature of rustls and rustls is the only dependent package of zlib-rs.

Read More

rust-rustls-0.23.17-1.el10_0 rust-zlib-rs-0.4.0-1.el10_0

Read Time:29 Second

FEDORA-EPEL-2024-21e104619e

Packages in this update:

rust-rustls-0.23.17-1.el10_0
rust-zlib-rs-0.4.0-1.el10_0

Update description:

Update the rustls crate to version 0.23.17.
Update the zlib-rs crate to version 0.4.0.

The update to zlib-rs v0.4.0 also addresses CVE-2024-11249 (stack overflow during decompression with malicious input). This issue had no actual impact in Fedora, because no applications yet use the the zlib-rs feature of rustls and rustls is the only dependent package of zlib-rs.

Read More

rust-rustls-0.23.17-1.fc40 rust-zlib-rs-0.4.0-1.fc40

Read Time:28 Second

FEDORA-2024-632b468c59

Packages in this update:

rust-rustls-0.23.17-1.fc40
rust-zlib-rs-0.4.0-1.fc40

Update description:

Update the rustls crate to version 0.23.17.
Update the zlib-rs crate to version 0.4.0.

The update to zlib-rs v0.4.0 also addresses CVE-2024-11249 (stack overflow during decompression with malicious input). This issue had no actual impact in Fedora, because no applications yet use the the zlib-rs feature of rustls and rustls is the only dependent package of zlib-rs.

Read More

rust-rustls-0.23.17-1.fc41 rust-zlib-rs-0.4.0-1.fc41

Read Time:28 Second

FEDORA-2024-41e6e2fc74

Packages in this update:

rust-rustls-0.23.17-1.fc41
rust-zlib-rs-0.4.0-1.fc41

Update description:

Update the rustls crate to version 0.23.17.
Update the zlib-rs crate to version 0.4.0.

The update to zlib-rs v0.4.0 also addresses CVE-2024-11249 (stack overflow during decompression with malicious input). This issue had no actual impact in Fedora, because no applications yet use the the zlib-rs feature of rustls and rustls is the only dependent package of zlib-rs.

Read More

rust-rustls-0.23.17-1.fc42 rust-zlib-rs-0.4.0-1.fc42

Read Time:28 Second

FEDORA-2024-6bcc5bbd5f

Packages in this update:

rust-rustls-0.23.17-1.fc42
rust-zlib-rs-0.4.0-1.fc42

Update description:

Update the rustls crate to version 0.23.17.
Update the zlib-rs crate to version 0.4.0.

The update to zlib-rs v0.4.0 also addresses CVE-2024-11249 (stack overflow during decompression with malicious input). This issue had no actual impact in Fedora, because no applications yet use the the zlib-rs feature of rustls and rustls is the only dependent package of zlib-rs.

Read More