CAPTCHA - Moderately Critical - Denial of Service - SA-CONTRIB-2017-073

* Advisory ID: DRUPAL-SA-CONTRIB-2017-073
* Project: CAPTCHA (third-party module)
* Version: 7.x
* Date: 2017-September-06
* Security risk: 10/25 ( Moderately Critical)
* Vulnerability: Denial of Service

DESCRIPTION

This module enables you to use various techniques to block automated scripts
/ robots from submitting content to a site, e.g. to block spam comments.

The module doesn't properly store the session ID of visitors who are given a
session which could lead to a Denial of Service attack.

This vulnerability is mitigated by the fact that Drupal does not give a
session to all visitors, especially when used with advanced caching systems
like Varnish.

VERSIONS AFFECTED

* CAPTCHA 7.x-1.x versions prior to 7.x-1.5.

Drupal core is not affected. If you do not use the contributed CAPTCHA module, there is nothing you need to do.

SOLUTION

Install the latest version:

* If you use the CATPCHA module for Drupal 7.x, upgrade to CAPTCHA 7.x-1.5.

Also see the CAPTCHA project page: https://www.drupal.org/project/captcha

Add new comment