CVE Request: drupal7-entity: multiple access bypass vulnerabilities

[Ratul Gupta <ratulg () redhat com>]

Hello,

The entity module for Drupal was recently reported to be affected by 
multiple access bypass vulnerabilites, which could be exploited by an 
attacker to gain unauthorized access to the data.

1) Comment, User and Node Statistics property access bypass

The module's entity wrapper access API doesn't sufficiently protect 
comment, user and node statistics properties from unprivileged user access.
This vulnerability is mitigated by the fact that a module must be 
enabled that relies on the Entity property access API and it must be 
configured to expose either comment, user or node statistics properties. 
One example would be the RESTful Web Services module (RESTWS) with the 
permission configured to access the comment, user or node resource for 
untrusted web service consumers.

2) Entity list property access bypass

The module's entity wrapper access API doesn't sufficiently check entity 
access on referenced entities such as taxonomy terms.
This vulnerability is mitigated by the fact that a module must be 
enabled that uses the access() method of entity metadata wrappers to 
determine access to a property which references multiple entities to 
which access is not granted. One example would be the RESTful Web 
Services module (RESTWS) with respectively configured permissions on an 
entity property or (entity reference) field, for example a list of 
(unaccessible) referenced user entities on a node entity.

3) Unpublished comments access bypass

The module's entity_access() API doesn't protect unpublished comments 
from being viewed by unprivileged users.
This vulnerability is mitigated by the fact a module must be enabled 
which uses the provided entity access API on comments and the comment 
module must be enabled.

The issues are said to be fixed in drupal7-entity-1.3.

References:
https://drupal.org/node/2169595
https://bugzilla.redhat.com/show_bug.cgi?id=1050802

Can CVE's please be assigned to these issues?

--
Regards,

Ratul Gupta / Red Hat Security Response Team