| Summary: | mediawiki new security issues fixed in 1.20.7 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Oden Eriksson <oe> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | davidwhodgins, luigiwalser, sysadmin-bugs |
| Version: | 3 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/566715/ | ||
| Whiteboard: | MGA2TOO MGA3-64-OK MGA3-32-OK MGA2-64-OK MGA2-32-OK | ||
| Source RPM: | mediawiki | CVE: | |
| Status comment: | |||
|
Description
Oden Eriksson
2013-09-04 13:50:00 CEST
David Walser
2013-09-04 14:31:36 CEST
Version:
2 =>
Cauldron Updated packages uploaded for Mageia 2, Mageia 3, and Cauldron. I don't believe we have any of the extensions mentioned packaged. I'll post an advisory once the CVEs have been assigned. It can be tested now. References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html https://www.mediawiki.org/wiki/Release_notes/1.20 ======================================== Updated packages in core/updates_testing: ======================================== mediawiki-1.20.7-1.mga2 mediawiki-mysql-1.20.7-1.mga2 mediawiki-pgsql-1.20.7-1.mga2 mediawiki-sqlite-1.20.7-1.mga2 mediawiki-1.20.7-1.mga3 mediawiki-mysql-1.20.7-1.mga3 mediawiki-pgsql-1.20.7-1.mga3 mediawiki-sqlite-1.20.7-1.mga3 from SRPMS: mediawiki-1.20.7-1.mga2.src.rpm mediawiki-1.20.7-1.mga3.src.rpm CC:
(none) =>
luigiwalser
David Walser
2013-09-04 16:39:56 CEST
Summary:
multiple vulnerabilities in mediawiki =>
mediawiki new security issues fixed in 1.20.7 Advisory: ======================== Updated mediawiki packages fix security vulnerabilities: Full path disclosure in MediaWiki before 1.20.7, when an invalid language is specified in ResourceLoader (CVE-2013-4301). Several API modules in MediaWiki before 1.20.7 allowed anti-CSRF tokens to be accessed via JSONP (CVE-2013-4302). An issue with the MediaWiki API in MediaWiki before 1.20.7 where an invalid property name could be used for XSS with older versions of Internet Explorer (CVE-2013-4303). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4301 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4302 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4303 http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html https://www.mediawiki.org/wiki/Release_notes/1.20 ======================== Updated packages in core/updates_testing: ======================== mediawiki-1.20.7-1.mga2 mediawiki-mysql-1.20.7-1.mga2 mediawiki-pgsql-1.20.7-1.mga2 mediawiki-sqlite-1.20.7-1.mga2 mediawiki-1.20.7-1.mga3 mediawiki-mysql-1.20.7-1.mga3 mediawiki-pgsql-1.20.7-1.mga3 mediawiki-sqlite-1.20.7-1.mga3 from SRPMS: mediawiki-1.20.7-1.mga2.src.rpm mediawiki-1.20.7-1.mga3.src.rpm Testing complete both arches, both releases and advisory committed to svn. Someone from the sysadmin team please push 11157.adv to updates. Keywords:
(none) =>
validated_update http://www.openwall.com/lists/oss-security/2013/09/05/5 "Top posting because I'm lazy CVE-2013-4301 MediaWiki full path disclosure in MediaWiki 46332 CVE-2013-4302 MediaWiki CSRF token access 49090 CVE-2013-4303 MediaWiki XSS with IE 52746 CVE-2013-4304 MediaWiki CentralAuth auth bypass CVE-2013-4305 MediaWiki SyntaxHighlight_GeSHi XSS CVE-2013-4306 MediaWiki CheckUser CSRF bypass CVE-2013-4307 MediaWiki Wikibase XSS CVE-2013-4308 MediaWiki LiquidThreads XSS" (In reply to Oden Eriksson from comment #4) > http://www.openwall.com/lists/oss-security/2013/09/05/5 > > "Top posting because I'm lazy > > CVE-2013-4301 MediaWiki full path disclosure in MediaWiki 46332 > CVE-2013-4302 MediaWiki CSRF token access 49090 > CVE-2013-4303 MediaWiki XSS with IE 52746 > CVE-2013-4304 MediaWiki CentralAuth auth bypass > CVE-2013-4305 MediaWiki SyntaxHighlight_GeSHi XSS > CVE-2013-4306 MediaWiki CheckUser CSRF bypass > CVE-2013-4307 MediaWiki Wikibase XSS > CVE-2013-4308 MediaWiki LiquidThreads XSS" Yes I saw that, but like I said, I don't believe we're shipping the plugins for those other CVEs.
David Walser
2013-09-13 17:42:45 CEST
URL:
http://www.openwall.com/lists/oss-security/2013/09/04/5 =>
http://lwn.net/Vulnerabilities/566715/ http://advisories.mageia.org/MGASA-2013-0276.html Status:
NEW =>
RESOLVED
Nicolas Vigier
2014-05-08 18:04:29 CEST
CC:
boklm =>
(none) |