CVE-2022-24728 (https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89): CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds. CVE-2022-24729 (https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh): CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds. Maintainers, are we vulnerable to these?
commit 7ddc64889b1bc2a991391d2a53f627d8c6bb2303 Author: Alfredo Tupone <tupone@gentoo.org> Date: Tue May 3 09:28:20 2022 +0200 www-apps/drupal: bump version
Still not sure if we are or were ever actually affected by this?
I think we are. Anything 9.1.x is affected and we still have 9.1.15 in tree.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=48b5eb917955c7dbad99bdba04f4d988d66e1813 commit 48b5eb917955c7dbad99bdba04f4d988d66e1813 Author: Viorel Munteanu <ceamac@gentoo.org> AuthorDate: 2023-03-11 07:16:35 +0000 Commit: Viorel Munteanu <ceamac@gentoo.org> CommitDate: 2023-03-11 11:03:41 +0000 www-apps/drupal: drop 9.1.15 drupal 9.1 reached end of life and no longer receives security updates. Bug: https://bugs.gentoo.org/831818 Bug: https://bugs.gentoo.org/835524 Bug: https://bugs.gentoo.org/873361 Signed-off-by: Viorel Munteanu <ceamac@gentoo.org> www-apps/drupal/Manifest | 1 - www-apps/drupal/drupal-9.1.15.ebuild | 68 ------------------------------------ 2 files changed, 69 deletions(-)
