Debian has issued an advisory on April 10: https://www.debian.org/security/2021/dsa-4889 Mageia 7 and 8 are also affected.
Source RPM: (none) => mediawiki-1.35.1-2.mga8.src.rpmWhiteboard: (none) => MGA8TOO, MGA7TOO
Hi, thanks for reporting this bug. As there is no maintainer for this package I added the committers in CC. (Please set the status to 'assigned' if you are working on it)
CC: (none) => bruno, luigiwalser, ouaurelienKeywords: (none) => TriagedCVE: (none) => CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[589]Assignee: bugsquad => pkg-bugs
Keywords: Triaged => (none)
Suggested advisory: ======================== The updated packages fix security vulnerabilities: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword. (CVE-2021-20270) A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-27291) An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for. (CVE-2021-30152) An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent page. (CVE-2021-30155) An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has security relevance because a blocked user might have accidentally shared a token, or might know that a token has been compromised, and yet is not able to block any potential future use of the token by an unauthorized party. (CVE-2021-30158) An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master. (CVE-2021-30159) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20270 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27291 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30152 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30155 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30158 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30159 https://www.debian.org/security/2021/dsa-4889 ======================== Updated packages in 7/core/updates_testing: ======================== mediawiki-1.31.14-1.mga7 mediawiki-mysql-1.31.14-1.mga7 mediawiki-pgsql-1.31.14-1.mga7 mediawiki-sqlite-1.31.14-1.mga7 from SRPM: mediawiki-1.31.14-1.mga7.src.rpm Updated packages in 8/core/updates_testing: ======================== mediawiki-1.35.2-1.mga8 mediawiki-mysql-1.35.2-1.mga8 mediawiki-pgsql-1.35.2-1.mga8 mediawiki-sqlite-1.35.2-1.mga8 from SRPM: mediawiki-1.35.2-1.mga8.src.rpm
Assignee: pkg-bugs => qa-bugsWhiteboard: MGA8TOO, MGA7TOO => MGA7TOOVersion: Cauldron => 8Status: NEW => ASSIGNED
The following references should be added to the advisory: https://lists.wikimedia.org/pipermail/mediawiki-announce/2021-April/000272.html https://lists.wikimedia.org/pipermail/mediawiki-announce/2021-April/000273.html
MGA7-64 Plasma on Lenovo B50 No installation issues. Tried to follow wiki as in previous updates, made sure mysqld and httpd are running, created datbase with phpmyadmin, and then follow link http://localhost/mediawiki/ and get error 404 page not found. That is caused by httpd already running before mediawiki is installed,need to restart httpd. Continuing ..........
CC: (none) => herman.viaene
Followed wiki with success, created wiki, created new page, works OK.
Whiteboard: MGA7TOO => MGA7TOO MGA7-64-OK
MGA8 Plasma VM x86_64 Installing Apache, php8, mariadb. Make sure they runs fine. Installing mediawiki from core repo. OK With phpmyadmin, creating database OK. Restart. Go http://localhost/mediawiki/ OK Updating. OK Go again http://localhost/mediawiki OK. New page OK. Good to go too. (In reply to David Walser from comment #3) > The following references should be added to the advisory: > https://lists.wikimedia.org/pipermail/mediawiki-announce/2021-April/000272. > html > https://lists.wikimedia.org/pipermail/mediawiki-announce/2021-April/000273. > html Validating. And yes added.
CC: (none) => sysadmin-bugsKeywords: (none) => advisory, validated_updateWhiteboard: MGA7TOO MGA7-64-OK => MGA7TOO MGA7-64-OK MGA8-64-OK
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0218.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED
Adding CVE-2021-30154 to the bug title, as that was missed.
Summary: mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[589] => mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[4589]CVE: CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[589] => CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[4589]
Adding CVE-2021-30157 to the bug title, as that was also missed: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/
Summary: mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[4589] => mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[45789]
CVE-2021-31556 was also fixed by this update: https://bugzilla.redhat.com/show_bug.cgi?id=1995202 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/
Summary: mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[45789] => mediawiki new security issues CVE-2021-20270, CVE-2021-27291, CVE-2021-30152, CVE-2021-3015[45789], CVE-2021-31556