it-securitynotifies AT lists.piratenpartei.de
Betreff: Sicherheitsankündigungen
Listenarchiv
[IT-SecNots] [Security-news] Clientside Validation - Critical - Arbitary PHP Execution - DRUPAL-SA-CONTRIB-2017-072
Chronologisch Thread
- From: security-news AT drupal.org
- To: security-news AT drupal.org
- Subject: [IT-SecNots] [Security-news] Clientside Validation - Critical - Arbitary PHP Execution - DRUPAL-SA-CONTRIB-2017-072
- Date: Wed, 6 Sep 2017 17:53:14 +0000 (UTC)
- List-archive: <http://lists.drupal.org/pipermail/security-news/>
- List-id: <security-news.drupal.org>
View online: https://www.drupal.org/node/2907118
* Advisory ID: DRUPAL-SA-CONTRIB-2017-072
* Project: Clientside Validation [1] (third-party module)
* Version: 7.x
* Date: 2017-September-06
* Security risk: 16/25 ( Critical)
AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2]
* Vulnerability: Arbitrary PHP code execution
-------- DESCRIPTION
---------------------------------------------------------
The Clientside Validation module enables you to have clientside (Javascript)
validation on your forms.
The module does not sufficiently validate parameters of a POST request made
when validating a CAPTCHA.
For the 1.x version of this module, this vulnerability is mitigated by the
fact that the CAPTCHA module must be enabled and the 'validate captcha'
option of the Clientside Validation module must be enabled (this option is
enabled by default).
For the 2.x version of this module, this vulnerability is mitigated by the
fact that the CAPTCHA module must be enabled and the Clientside Validation
captcha submodule must be enabled.
-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------
* /A CVE identifier [3] will be requested, and added upon issuance, in
accordance with Drupal Security Team processes./
-------- VERSIONS AFFECTED
---------------------------------------------------
* Clientside Validation 7.x-1.x versions prior to 7.x-1.44.
* Clientside Validation 7.x-2.x versions prior to 7.x-2.0-beta1.
Drupal core is not affected. If you do not use the contributed Clientside
Validation [4] module, there is nothing you need to do.
-------- SOLUTION
------------------------------------------------------------
Install the latest version:
* If you use the 1.x version of Clientside Validation module for Drupal 7.x,
upgrade to Clientside Validation 7.x-1.45 [5]
* If you use the 2.x version of Clientside Validation module for Drupal 7.x,
upgrade to Clientside Validation 7.x-2.0-beta2 [6]
Also see the Clientside Validation [7] project page.
-------- REPORTED BY
---------------------------------------------------------
* Daniel-SCRT [8]
-------- FIXED BY
------------------------------------------------------------
* Jelle Sebreghts [9] the module maintainer
-------- COORDINATED BY
------------------------------------------------------
* Greg Knaddison [10] of the Drupal Security Team
-------- CONTACT AND MORE INFORMATION
----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the
contact form at https://www.drupal.org/contact [11].
Learn more about the Drupal Security team and their policies [12], writing
secure code for Drupal [13], and securing your site [14].
Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [15]
[1] https://www.drupal.org/project/clientside_validation
[2] https://www.drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] https://www.drupal.org/project/clientside_validation
[5] https://www.drupal.org/project/clientside_validation/releases/7.x-1.45
[6]
https://www.drupal.org/project/clientside_validation/releases/7.x-2.0-beta2
[7] https://www.drupal.org/project/clientside_validation
[8] https://www.drupal.org/u/daniel-scrt
[9] https://www.drupal.org/u/jelle_s
[10] https://www.drupal.org/u/greggles
[11] https://www.drupal.org/contact
[12] https://www.drupal.org/security-team
[13] https://www.drupal.org/writing-secure-code
[14] https://www.drupal.org/security/secure-configuration
[15] https://twitter.com/drupalsecurity
_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news
- [IT-SecNots] [Security-news] Clientside Validation - Critical - Arbitary PHP Execution - DRUPAL-SA-CONTRIB-2017-072, security-news, 06.09.2017
Archiv bereitgestellt durch MHonArc 2.6.19.