PSA-2020-06-24
Date: 2020-June-24The Drupal Security Team has announced today that given the impact of COVID-19 on budgets and businesses Drupal 7's end-of-life, previously scheduled for November 2021, will be extended until November 28, 2022.
Project: Internationalization
Version: 7.x-1.x-dev
Date: 2020-June-17
Security risk: Moderately critical 14∕25
Vulnerability: Cross site scriptingThe Internationalization (i18n) module is a collection of modules to extend Drupal 7 core multilingual capabilities and allows to build real life multilingual sites.
A value in the term translation module is displayed without being escaped leading to a Cross Site Scripting (XSS) vulnerability.
Project: Drupal core
Date: 2020-June-17
Security risk: Less critical 8∕25
Vulnerability: Access bypass
CVE IDs: CVE-2020-13665JSON:API PATCH requests may bypass validation for certain fields.
By default, JSON:API works in a read-only mode which makes it impossible to exploit the vulnerability. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable.
Install the latest version:
Project: Drupal core
Date: 2020-June-17
Security risk: Critical 17∕25
Vulnerability: Arbitrary PHP code execution
CVE IDs: CVE-2020-13664Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances.
An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability.
Project: Drupal core
Date: 2020-June-17
Security risk: Critical 15∕25
Vulnerability: Cross Site Request Forgery
CVE IDs: CVE-2020-13663The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
Project: YubiKey
Version: 7.x-2.x-dev
Date: 2020-June-10
Security risk: Less critical 9∕25
Vulnerability: Access bypassThis module enables you to use a Yubikey device to protect your Drupal user account. YubiKey is a secure method for logging into many websites using a cryptographically secure USB token.
Project: Open ReadSpeaker
Version: 8.x-1.x-dev
Date: 2020-June-10
Security risk: Moderately critical 13∕25
Vulnerability: Cross site scriptingThis module enables you to add a configured ReadSpeaker button for text-to-speech for your site visitors.
The module doesn't sufficiently sanitize block configuration causing a Cross Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks".
This security and maintenance release features 22 fixes and enhancements. Plus, it adds a number of security fixes—see the list below.
These bugs affect WordPress versions 5.4.1 and earlier; version 5.4.2 fixes them, so you’ll want to upgrade.
If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the bugs for you.
Security Updates
The first official release of Drupal 9 has been announced today on June 3, 2020. This is the first supported release of the new Drupal 9 major version, and it is ready for use on production sites!
Project: Services
Version: 7.x-3.x-dev
Date: 2020-June-03
Security risk: Moderately critical 11∕25
Vulnerability: Access bypassThis module provides a standardized solution for building API's so that external clients can communicate with Drupal.
The module's taxonomy term index resource doesn't take into consideration certain access control tags provided (but unused) by core, that certain contributed modules depend on.