Security

Backdrop core - Critical - Third-party libraries - BACKDROP-SA-CORE-2021-001

Nick

Marketing Project Manager

Jan 27, 2021
Add comment

Backdrop core - Critical - Third-party libraries - BACKDROP-SA-CORE-2021-001

Date: Wednesday, Jan 27th, 2021
Security risk: Critical
Advisory ID: BACKDROP-SA-CORE-2021-001
CVE ID: CVE-2020-36193
Vulnerability: Third Party Libraries
Versions affected: Backdrop Core 1.18.x versions prior to 1.18.1, Backdrop Core 1.17.x versions prior to 1.17.6
Backdrop versions 1.16 and prior do not receive security coverage.

Description

The Backdrop project uses the pear Archive_Tar library, which has released a security update that impacts Backdrop. For more information please see:

Subgroup - Less critical - Access bypass - SA-CONTRIB-2021-003

Nick

Marketing Project Manager

Jan 27, 2021
Add comment

Subgroup - Less critical - Access bypass - SA-CONTRIB-2021-003

Project: Subgroup
Version: 1.0.x-dev
Date: 2021-January-27
Security risk: Less critical 9∕25 
Vulnerability:Access bypass

Description

This module enables you to add groups to other groups in a tree structure where access can be inherited up or down the tree.

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2021-001

Nick

Marketing Project Manager

Jan 27, 2021
Add comment

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2021-001

Project: Open Social
Versions: 8.x-9.x-dev, 8.x-8.x-dev
Date: 2021-January-27
Security risk: Moderately critical 12∕25
Vulnerability: Access bypass

Description

The optional Social Auth Extra module enables you to use the single sign-on methods provided by Open Social e.g. Facebook, LinkedIn, Google and Twitter.

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2021-002

Nick

Marketing Project Manager

Jan 27, 2021
Add comment

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2021-002

Project: Open Social
Versions: 8.x-9.x-dev, 8.x-8.x-dev
Date: 2021-January-27
Security risk: Moderately critical 10∕25
Vulnerability: Access bypass

Description

The Social User Export module enables users within Open Social to create an export of users and download this to a CSV file.

Drupal core - Critical - Third-party libraries - SA-CORE-2021-001

Nick

Marketing Project Manager

Jan 20, 2021
Add comment

Drupal core - Critical - Third-party libraries - SA-CORE-2021-001

Project: Drupal core
Date: 2021-January-20
Security risk: Critical 18∕25
Vulnerability: Third-party libraries

Description

The Drupal project uses the pear Archive_Tar library, which has released a security update that impacts Drupal. For more information please see:

Backdrop core - Critical - Arbitrary PHP code execution - BACKDROP-SA-CORE-2020-008

Nick

Marketing Project Manager

Nov 26, 2020
Add comment

Backdrop core - Critical - Arbitrary PHP code execution - BACKDROP-SA-CORE-2020-008

Date: Wednesday, Nov 25th, 2020
Security risk: Critical
Advisory ID: BACKDROP-SA-CORE-2020-008
CVE ID: CVE-2020-28948, CVE-2020-28949
Vulnerability: Arbitrary PHP code execution

Versions affected

Backdrop Core 1.17.x versions prior to 1.17.4
Backdrop Core 1.16.x versions prior to 1.16.6

Backdrop versions 1.15 and prior do not receive security coverage.

There are known exploits! Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013

Nick

Marketing Project Manager

Nov 26, 2020
Add comment

There are known exploits! Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013

Project: Drupal core
Date: 2020-November-25
Security risk: Critical 18∕25 
Vulnerability: Arbitrary PHP code execution
CVE IDs: CVE-2020-28949,CVE-2020-28948

Description

The Drupal project uses the PEAR Archive_Tar library. The PEAR Archive_Tar library has released a security update that impacts Drupal. For more information please see:

Backdrop core - Critical - Remote code execution - SA-CORE-2020-007

Nick

Marketing Project Manager

Nov 19, 2020
Add comment

Backdrop core - Critical - Remote code execution - SA-CORE-2020-007

Date: Wednesday, Nov 18th, 2020
Security risk: Critical
Advisory ID: BACKDROP-SA-CORE-2020-007
CVE ID: CVE-2020-13671
Vulnerability: Remote Code Execution

Versions affected

Backdrop Core 1.17.x versions prior to 1.17.3
Backdrop Core 1.16.x versions prior to 1.16.5

Backdrop versions 1.15 and prior do not receive security coverage.

Multiple security advisories are issued for Drupal 7, 8, 9 core and contributed modules: SA-CORE-2020-012, SA-CONTRIB-2020-035, SA-CONTRIB-2020-036, SA-CONTRIB-2020-037, SA-CONTRIB-2020-038

Nick

Marketing Project Manager

Nov 18, 2020
Add comment

Multiple security advisories are issued for Drupal 7, 8, 9 core and contributed modules: SA-CORE-2020-012, SA-CONTRIB-2020-035, SA-CONTRIB-2020-036, SA-CONTRIB-2020-037, SA-CONTRIB-2020-038

Media: oEmbed - Critical - Remote Code Execution - SA-CONTRIB-2020-036

Project: Media: oEmbed
Date: 2020-November-18
Security risk: Critical 17∕25 
Vulnerability: Remote Code Execution

Description

Media oEmbed does not properly sanitize certain filenames as described in SA-CORE-2020-012.

Solution

Install the latest version:

Upgrade to Media oEmbed 7.x-2.8

Drupal OAuth Server (OAuth Provider) - Single Sign On ( SSO ) - SQL Injection -SA-CONTRIB-2020-034

Nick

Marketing Project Manager

Oct 14, 2020
Add comment

Drupal OAuth Server (OAuth Provider) - Single Sign On ( SSO ) - SQL Injection -SA-CONTRIB-2020-034

Project: Drupal OAuth Server ( OAuth Provider) - Single Sign On ( SSO )
Date: 2020-October-14
Vulnerability: SQL Injection

Description

This module enables you login into any OAuth 2.0 compliant application using Drupal credentials.

The 8.x branch of the module is vulnerable to SQL injection.

Solution

Install the latest version:

If you use the Drupal OAuth Server module for Drupal 8.x, upgrade to 8.x-1.1

Security

Description

Description

Description

Description

Description

Versions affected

Description

Versions affected

Media: oEmbed - Critical - Remote Code Execution - SA-CONTRIB-2020-036

Description

Solution

Description

Solution

Pages