* Advisory ID: DRUPAL-SA-CONTRIB-2017-073
* Project: CAPTCHA (third-party module)
* Version: 7.x
* Date: 2017-September-06
* Security risk: 10/25 ( Moderately Critical)
* Vulnerability: Denial of Service
This module enables you to use various techniques to block automated scripts
/ robots from submitting content to a site, e.g. to block spam comments.
The module doesn't properly store the session ID of visitors who are given a
session which could lead to a Denial of Service attack.
This vulnerability is mitigated by the fact that Drupal does not give a
session to all visitors, especially when used with advanced caching systems
* CAPTCHA 7.x-1.x versions prior to 7.x-1.5.
Drupal core is not affected. If you do not use the contributed CAPTCHA module, there is nothing you need to do.
Install the latest version:
* If you use the CATPCHA module for Drupal 7.x, upgrade to CAPTCHA 7.x-1.5.
Also see the CAPTCHA project page: https://www.drupal.org/project/captcha