SA-CONTRIB-2012-056 - Janrain Engage - Sensitive Data Protection Vulnerability

By Drupal Security Team on 4 Apr 2012 at 17:58 UTC

Advisory ID: DRUPAL-SA-CONTRIB-2012-056
Project: Janrain Engage (formerly RPX) (third-party module)
Version: 6.x, 7.x
Date: 2012-April-04
Security risk: Less critical
Exploitable from: Not exploitable
Vulnerability: Sensitive Data Protection Vulnerability

Description

CVE: CVE-2012-2296

Using Janrain Engage, Drupal sites can authenticate new and existing users with popular social networks, map user profile data from these websites to Drupal fields, and share Drupal content with a user's friends on their social networks.

The module permanently retains the complete user profile data returned from Engage in the users table. Only a subset of that data is needed for a limited time. The profile data is also stored in the sessions table. This is undesirable as it may include sensitive information (such as provider access tokens).

This is not an immediate vulnerability per se as it does not create an attack vector (i.e. it cannot be exploited) but it makes other weaknesses much more critical (e.g. a data breach could be parlayed into privilege escalation).

Versions affected

Janrain Engage (formerly RPX) 6.x-1.x versions (all).
Janrain Engage (formerly RPX) 6.x-2.x versions prior to 6.x-2.2.
Janrain Engage (formerly RPX) 7.x-2.x versions prior to 7.x-2.2.

Drupal core is not affected. If you do not use the contributed Janrain Engage (formerly RPX) module, there is nothing you need to do.

Solution

Install the latest version:

If you use Janrain Engage (formerly RPX) for Drupal 6.x, upgrade to version 6.x-2.2
If you use Janrain Engage (formerly RPX) for Drupal 7.x, upgrade to version 7.x-2.2

Also see the Janrain Engage (formerly RPX) project page.