Mailchimp api versions below v1.0.7 have a serious security vulnerability: https://github.com/thinkshout/mailchimp-api-php/issues/90.

The module and project homepage should make it more clear that older versions should not be used.

CommentFileSizeAuthor
#8 3072827-75x-8.patch1.13 KBsamuel.mortenson
#8 3072827-74x-8.patch889 bytessamuel.mortenson

Comments

hansrossel created an issue. See original summary.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Issue tags: +Security

I believe some of tasks 2 and 3 are done on some of the branches, but it would be good to do them on all 3 branches. Adding a relevant tag.

hansrossel’s picture

hansrossel commented

Based on https://www.drupal.org/project/mailchimp/issues/2946280#comment-13223376:

The unmodified version 1.0.7 also has a security issue: spamming using the phpunit files.
Version 1.0.8 does not have those files.

So recommend at least version 1.0.8 also for existing installations.

samuel.mortenson’s picture

samuel.mortenson
he/him
Primary language English
commented

We're talking about this on Github a bit: https://github.com/thinkshout/mailchimp-api-php/issues/90#issuecomment-5...

Bumping the Composer requirement seems fine, but as mentioned in my Github comment I think this is only a problem with the ZIP releases of the Mailchimp library, _not_ with the Composer releases since they mark PHPUnit as a dev dependency, which shouldn't be installed in production. If I'm missing something there please let me know in Github.

samuel.mortenson’s picture

samuel.mortenson
he/him
Primary language English
commented

In this issue we're going to backport the hook_requirements code that checks the library version from 7.x-5.x to 7.x-4.x and try to do a new release soon.

samuel.mortenson’s picture

samuel.mortenson
he/him
Primary language English
commented
Assigned: Unassigned » aprice42
mshaver’s picture

mshaver commented
Assigned: aprice42 » samuel.mortenson
samuel.mortenson’s picture

samuel.mortenson
he/him
Primary language English
commented
Status: Active » Needs review
StatusFileSize
new 3072827-74x-8.patch889 bytes
new 3072827-75x-8.patch1.13 KB

Here are patches to add the requirements check to 7.x-4.x and bump the version for 7.x-5.x.

  • samuel.mortenson authored dd9e2f4 on 7.x-5.x 
    Issue #3072827 by samuel.mortenson, hansrossel: Mailchimp api versions...

  • samuel.mortenson authored d331d1e on 7.x-4.x 
    Issue #3072827 by samuel.mortenson, hansrossel: Mailchimp api versions...
samuel.mortenson’s picture

samuel.mortenson
he/him
Primary language English
commented
Status: Needs review » Fixed

hook_requirements code has been updated to require 1.0.8+, hopefully this will push more people who have an outdated library to update.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

Thanks, samuel.mortenson!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.