[IT-SecNots] [Security-news] Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-core-2020-002

Project: Drupal core [1]
Date: 2020-May-20
Security risk: *Moderately critical* 10∕25
AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2]
Vulnerability: Cross Site Scripting

Description: 
The jQuery project released version 3.5.0, and as part of that, disclosed two
security vulnerabilities that affect all prior versions. As mentioned in the
jQuery blog [3], both are

 >[...] security issues in jQuery’s DOM manipulation methods, as in 
.html(),
 >.append(), and the others. Security advisories for both of these issues 
have
 >been published on GitHub.
 >
Those advisories are:

  * CVE-2020-11022 [4]
  * CVE-2020-11023 [5]

These vulnerabilities may be exploitable on some Drupal sites. This Drupal
security release backports the fixes to the relevant jQuery functions,
without making any other changes to the jQuery version that is included in
Drupal core or running on the site via some other module such as jQuery
Update [6]. It is not necessary to update jquery_update on Drupal 7 sites
that have the module installed.

Backwards-compatibility code has also been added to minimize regressions to
Drupal sites that might rely on jQuery's prior behavior. With jQuery 3.5,
incorrect self-closing HTML tags in JavaScript for elements where end tags
are normally required will encounter a change in what jQuery returns or
inserts [7]. To minimize that disruption in 8.8.x and earlier, this security
release retains jQuery's prior behavior for most safe tags. There may still
be regressions for edge cases, including invalidly self-closed custom
elements [8] on Internet Explorer.

(Note: the backwards compatibility layer will not be included in the upcoming
Drupal 8.9 and 9.0 releases, so Drupal 8 and 9 modules, themes, and sites
should correct tags in JavaScript to properly use closing tags.)

If you find a regression [9] caused by the jQuery changes, please report it
in Drupal core's issue queue [10] (or that of the relevant contrib project).
However, if you believe you have found a security issue, please report it
privately to the Drupal Security Team [11].

Solution: 
Install the latest version:

  * If you are using Drupal 8.8, upgrade to Drupal 8.8.6 [12].
  * If you are using Drupal 8.7, upgrade to Drupal 8.7.14 [13].
  * If you are using Drupal 7, upgrade to Drupal 7.70 [14].

Versions of Drupal 8 prior to 8.7 are end-of-life and do not receive security
coverage. Sites on 8.6 or earlier should update to 8.7.14.

The pre-release Drupal versions (8.9 and 9.0) have been updated jQuery to
version 3.5.1 as of 8.9.0-beta3 and 9.0.0-beta3.

Reported By: 
  * Drew Webber  [15] of the Drupal Security Team
  * Emerson Jair Reis Oliveira da Silva  [16]

Fixed By: 
  * Drew Webber  [17] of the Drupal Security Team
  * Sally Young  [18]
  * cilefen  [19] of the Drupal Security Team
  * Jess   [20] of the Drupal Security Team
  * Emerson Jair Reis Oliveira da Silva  [21]
  * Lee Rowlands  [22] of the Drupal Security Team
  * Alex Bronstein  [23] of the Drupal Security Team
  * Ben Mullins  [24]
  * Lauri Eskola  [25]
  * Peter Weber  [26]
  * Samuel Mortenson  [27] of the Drupal Security Team


[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3]
https://blog.jquery.com/2020/05/04/jquery-3-5-1-released-fixing-a-regression/
[4] https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
[5] https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6
[6] https://www.drupal.org/project/jquery_update
[7] https://jquery.com/upgrade-guide/3.5/#description-of-the-change
[8] https://html.spec.whatwg.org/multipage/custom-elements.html
[9] https://en.wikipedia.org/wiki/Software_regression
[10] https://www.drupal.org/project/issues/drupal
[11] https://www.drupal.org/security-team/report-issue
[12] https://www.drupal.org/project/drupal/releases/8.8.6
[13] https://www.drupal.org/project/drupal/releases/8.7.14
[14] https://www.drupal.org/project/drupal/releases/7.70
[15] https://www.drupal.org/user/255969
[16] https://www.drupal.org/user/3580914
[17] https://www.drupal.org/user/255969
[18] https://www.drupal.org/user/161058
[19] https://www.drupal.org/user/1850070
[20] https://www.drupal.org/user/65776
[21] https://www.drupal.org/user/3580914
[22] https://www.drupal.org/user/395439
[23] https://www.drupal.org/user/78040
[24] https://www.drupal.org/user/2369194
[25] https://www.drupal.org/user/1078742
[26] https://www.drupal.org/user/1448368
[27] https://www.drupal.org/user/2582268

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news