SA-CONTRIB-2018-020: Media 7.x-1.x

while it might not be, there's already a known SA in 7.x-1.x

If on 7.x-1.x , please upgrade to 7.x-2.19 or 7.x-3.0-rc5 soon, please refer to these notes and issues for upgrading from 7.x-1.x to 7.x-2.19;
#2853273: upgrading from 1.x to 2.x support
#2082037: Document Upgrade Path from Media 1.x to Media 2.x/3.x

Multilingual sites:
Please note, if you are using this release in combination with entity_translation you must then upgrade entity_translation to entity_translation beta6 (minimum) however preferably entity_translation 1.0 or newer.

What about 7.x-2.0-alpha3 ? If the media_ajax_upload isn't there, can we assume that this isn't vulnerable to that SA, right?
Also didn't find any usage of element parents.

Upgrading to 2.x is certainly the better option, but we can't do that in a couple of hours time. In the mean time Drupal could be open to a remote code execution vulnerability.

I'd rather fix that first and then plan an upgrade.

@joseph.olstad; what other SA are you referring to? The only one that I can find is SA-CONTRIB-2017-042

By your own research it would appear not affected. With that said, 1.x is not officially supported but the upgrade path to 2.x is.

Can anyone confirm whether this bug affects if the media module is not used by users? I have many sites that only have one admin user - is this patch still needed for those?

That interests me too!

The attacker must have rights to upload media, right?

If you're interested in patching for the previous SA, here you can find a patch:
https://www.drupal.org/project/media/issues/2966323

If you are unable to upgrade to 2.x
media 1.7 was just released with the backported fix for SA-CONTRIB-2017-042

as for the 2018 one, I checked the 1.x code base, it is not affecting 1.x branch.

the recommended release is 7.x-2.19

however for those stuck on 1.x you can upgrade to 1.7.

7.x-1.7 is not marked as a security release:

...so basically, people that have set their E-mail notification threshold to "Only security updates" will never be notified.

If I am not mistaken, this is just a checkbox in the release that one of the maintainers needs to set. Can we please do that? Thanks

1.x was unsupported up until that release for over a year, everyone up until that date of release of 1.7 got the SA security advisory and was recommended to upgrade to 2.x for over a year now. This release was a simple courtesy release to those that were unable to upgrade to 2.x