Bug 28883 - mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[45789], CVE-2021-31556
Summary: mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152,...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7TOO MGA7-64-OK MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-05-06 12:55 CEST by Nicolas Salguero
Modified: 2021-10-13 15:47 CEST (History)
5 users (show)

See Also:
Source RPM: mediawiki-1.35.1-2.mga8.src.rpm
CVE: CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[4589]
Status comment:


Attachments

Description Nicolas Salguero 2021-05-06 12:55:14 CEST
Debian has issued an advisory on April 10:
https://www.debian.org/security/2021/dsa-4889

Mageia 7 and 8 are also affected.
Nicolas Salguero 2021-05-06 12:55:48 CEST

Source RPM: (none) => mediawiki-1.35.1-2.mga8.src.rpm
Whiteboard: (none) => MGA8TOO, MGA7TOO

Comment 1 Aurelien Oudelet 2021-05-06 15:52:47 CEST
Hi, thanks for reporting this bug.
As there is no maintainer for this package I added the committers in CC.

(Please set the status to 'assigned' if you are working on it)

CC: (none) => bruno, luigiwalser, ouaurelien
Keywords: (none) => Triaged
CVE: (none) => CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[589]
Assignee: bugsquad => pkg-bugs

Aurelien Oudelet 2021-05-06 15:52:57 CEST

Keywords: Triaged => (none)

Comment 2 Nicolas Salguero 2021-05-11 12:05:51 CEST
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword. (CVE-2021-20270)

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-27291)

An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for. (CVE-2021-30152)

An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent page. (CVE-2021-30155)

An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has security relevance because a blocked user might have accidentally shared a token, or might know that a token has been compromised, and yet is not able to block any potential future use of the token by an unauthorized party. (CVE-2021-30158)

An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master. (CVE-2021-30159)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20270
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27291
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30152
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30155
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30158
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30159
https://www.debian.org/security/2021/dsa-4889
========================

Updated packages in 7/core/updates_testing:
========================
mediawiki-1.31.14-1.mga7
mediawiki-mysql-1.31.14-1.mga7
mediawiki-pgsql-1.31.14-1.mga7
mediawiki-sqlite-1.31.14-1.mga7

from SRPM:
mediawiki-1.31.14-1.mga7.src.rpm

Updated packages in 8/core/updates_testing:
========================
mediawiki-1.35.2-1.mga8
mediawiki-mysql-1.35.2-1.mga8
mediawiki-pgsql-1.35.2-1.mga8
mediawiki-sqlite-1.35.2-1.mga8

from SRPM:
mediawiki-1.35.2-1.mga8.src.rpm

Assignee: pkg-bugs => qa-bugs
Whiteboard: MGA8TOO, MGA7TOO => MGA7TOO
Version: Cauldron => 8
Status: NEW => ASSIGNED

Comment 4 Herman Viaene 2021-05-14 18:02:53 CEST
MGA7-64 Plasma on Lenovo B50
No installation issues.
Tried to follow wiki as in previous updates, made sure mysqld and httpd are running, created datbase with phpmyadmin, and then follow link http://localhost/mediawiki/
and get error 404 page not found.
That  is caused by httpd already running before mediawiki is installed,need to restart httpd.
Continuing ..........

CC: (none) => herman.viaene

Comment 5 Herman Viaene 2021-05-14 18:32:07 CEST
Followed wiki with success, created wiki, created new page, works OK.

Whiteboard: MGA7TOO => MGA7TOO MGA7-64-OK

Comment 6 Aurelien Oudelet 2021-05-22 18:52:33 CEST
MGA8 Plasma VM x86_64

Installing Apache, php8, mariadb. Make sure they runs fine.
Installing mediawiki from core repo. OK
With phpmyadmin, creating database OK.
Restart.
Go http://localhost/mediawiki/ OK

Updating. OK
Go again http://localhost/mediawiki OK. New page OK.

Good to go too.


(In reply to David Walser from comment #3)
> The following references should be added to the advisory:
> https://lists.wikimedia.org/pipermail/mediawiki-announce/2021-April/000272.
> html
> https://lists.wikimedia.org/pipermail/mediawiki-announce/2021-April/000273.
> html

Validating.
And yes added.

CC: (none) => sysadmin-bugs
Keywords: (none) => advisory, validated_update
Whiteboard: MGA7TOO MGA7-64-OK => MGA7TOO MGA7-64-OK MGA8-64-OK

Comment 7 Mageia Robot 2021-05-23 03:32:48 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0218.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED

Comment 8 David Walser 2021-05-27 23:58:06 CEST
Adding CVE-2021-30154 to the bug title, as that was missed.

Summary: mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[589] => mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[4589]
CVE: CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[589] => CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[4589]

Comment 9 David Walser 2021-05-29 22:48:17 CEST
Adding CVE-2021-30157 to the bug title, as that was also missed:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/

Summary: mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[4589] => mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[45789]

Comment 10 David Walser 2021-10-13 15:47:17 CEST
CVE-2021-31556 was also fixed by this update:
https://bugzilla.redhat.com/show_bug.cgi?id=1995202
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/

Summary: mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[45789] => mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[45789], CVE-2021-31556


Note You need to log in before you can comment on or make changes to this bug.