Description
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.0.0, < 10.1.8 | 10.1.8 | GHSA-6ccv-8fgf-cjpw |
| Packagist | drupal/core | >= 10.2.0, < 10.2.2 | 10.2.2 | GHSA-6ccv-8fgf-cjpw |
References
- https://github.com/drupal/core/commit/2f76ac716ca8019bc60579fdfc8aa6cd65d57dff web
- https://github.com/drupal/core/commit/5e606b560ac4ecb08135f12b6165bbe0348346a0 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2024-01-17.yaml web
- https://github.com/drupal/core package
- https://www.drupal.org/sa-core-2024-001 web