Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039
Project: Security KitDate: 2024-September-11Security risk: Less critical 9 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:DefaultVulnerability: Denial of ServiceAffected versions: <2.0.3Description: This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP response headers.
The module doesn't sufficiently validate input in Content Security Policy (CSP) violation reports. This can cause errors when a logging module (e.g. dblog or syslog) attempts to parse the resulting log message which contains invalid data.
This vulnerability is mitigated by the fact that to be affected a site must have seckit's CSP reporting functionality enabled. Recent versions of Drupal 10 and 11 core are not vulnerable due to improved parsing of log messages.Solution: Install the latest version:
- If you use the 7.x-1.x branch of the seckit module, upgrade to seckit 7.x-1.13
- If you use the 2.0.x branch of the seckit module, upgrade to seckit 2.0.3
Reported By:
Fixed By:
- jweowu
- Drew Webber of the Drupal Security Team
Coordinated By:
- Greg Knaddison of the Drupal Security Team
- Drew Webber of the Drupal Security Team
- Heine Deelstra of the Drupal Security Team
