| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| drupal/seckit | < 2.0.3 | 2.0.3 |
| security kit | < 2.0.3 | 2.0.3 |
This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP response headers.
The module doesn't sufficiently validate input in Content Security Policy (CSP) violation reports. This can cause errors when a logging module (e.g. dblog or syslog) attempts to parse the resulting log message which contains invalid data.
This vulnerability is mitigated by the fact that to be affected a site must have seckit's CSP reporting functionality enabled. Recent versions of Drupal 10 and 11 core are not vulnerable due to improved parsing of log messages.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン