Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Wikipedia: Wikitech

MediaWiki security release: 1.19.2 and 1.18.5

 

 

Wikipedia wikitech RSS feed   Index | Next | Previous | View Threaded


csteipp at wikimedia

Aug 30, 2012, 9:55 PM

Post #1 of 4 (529 views)
Permalink
MediaWiki security release: 1.19.2 and 1.18.5

I would like to announce the release of MediaWiki 1.19.2 and 1.18.5.
These releases fix 6 security related bugs that could affect users of
MediaWiki. Download links are given at the end of this email.

* Wikipedia administrator Writ Keeper discovered a stored XSS (HTML
injection) vulnerability. This was possible due to the handling of
link text on File: links for nonexistent files. MediaWiki 1.16 and
later is affected. For more details, see
<https://bugzilla.wikimedia.org/show_bug.cgi?id=39700>

* User Fomafix reported several DOM-based XSS vulnerabilities, made
possible by a combination of loose filtering of the uselang parameter,
and JavaScript gadgets on various language Wikipedias. For more
details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=37587>

* During internal review, it was discovered that CSRF tokens,
available via the api, were not protected with X-Frame-Options
headers. This could lead to a CSRF vulnerability if the API response
is embedded in an external website using an iframe. For more details,
see <https://bugzilla.wikimedia.org/show_bug.cgi?id=39180>

* During internal review, it was discovered extensions were not always
allowed to prevent the account creation action. This allowed users
blocked by the GlobalBlocking extension to create accounts. For more
details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=39824>

* During internal review, it was discovered that password data was
always saved to the local MediaWiki database, even if authentication
was handled by an extension, such as LDAP. This could allow a
compromised MediaWiki installation to leak information about user's
LDAP passwords. Additionally, in situations when an authentication
plugin returned false in its strict function, this would allow old
passwords to be used for accounts that did not exist in the external
system, indefinitely. For details on how to clean up the data leakage,
see: <https://bugzilla.wikimedia.org/show_bug.cgi?id=39184>

* During internal review, it was discovered that metadata about
blocks, hidden by a user with suppression rights, was visible to
administrators. For more details, see
<https://bugzilla.wikimedia.org/show_bug.cgi?id=39823>


Full release notes for 1.19.2:
<https://www.mediawiki.org/wiki/Release_notes/1.19>

Full release notes for 1.18.5:
<https://www.mediawiki.org/wiki/Release_notes/1.18>

For information about how to upgrade, see
<https://www.mediawiki.org/wiki/Manual:Upgrading>

**********************************************************************
1.19.2
**********************************************************************
Download:
http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.2.tar.gz

Patch to previous version (1.19.1):
http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.2.patch.gz

GPG signatures:
http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.2.tar.gz.sig
http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.2.patch.gz.sig

Public keys:
https://secure.wikimedia.org/keys.html

**********************************************************************
1.18.5
**********************************************************************
Download:
http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.5.tar.gz

Patch to previous version (1.18.4), without interface text:
http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.5.patch.gz
Interface text changes:
http://download.wikimedia.org/mediawiki/1.18/mediawiki-i18n-1.18.5.patch.gz

GPG signatures:
http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.5.tar.gz.sig
http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.5.patch.gz.sig
http://download.wikimedia.org/mediawiki/1.18/mediawiki-i18n-1.18.5.patch.gz.sig

Public keys:
https://secure.wikimedia.org/keys.html

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


niklas.laxstrom at gmail

Aug 31, 2012, 3:59 AM

Post #2 of 4 (449 views)
Permalink
Re: MediaWiki security release: 1.19.2 and 1.18.5 [In reply to]

On 31 August 2012 07:55, Chris Steipp <csteipp [at] wikimedia> wrote:
> I would like to announce the release of MediaWiki 1.19.2 and 1.18.5.
> These releases fix 6 security related bugs that could affect users of
> MediaWiki. Download links are given at the end of this email.

I don't see updates in git REL1_19 branch nor does tag 1.19.2 exist.
Same probably applies to 1.18.
-Niklas

--
Niklas Laxström

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


csteipp at wikimedia

Aug 31, 2012, 10:07 AM

Post #3 of 4 (448 views)
Permalink
Re: MediaWiki security release: 1.19.2 and 1.18.5 [In reply to]

REL1_19 is merged and tagged now. Apologies for the delay.

I'm still working on getting REL1_18 finished.

On Fri, Aug 31, 2012 at 3:59 AM, Niklas Laxström
<niklas.laxstrom [at] gmail> wrote:
> On 31 August 2012 07:55, Chris Steipp <csteipp [at] wikimedia> wrote:
>> I would like to announce the release of MediaWiki 1.19.2 and 1.18.5.
>> These releases fix 6 security related bugs that could affect users of
>> MediaWiki. Download links are given at the end of this email.
>
> I don't see updates in git REL1_19 branch nor does tag 1.19.2 exist.
> Same probably applies to 1.18.
> -Niklas
>
> --
> Niklas Laxström
>
> _______________________________________________
> Wikitech-l mailing list
> Wikitech-l [at] lists
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


smazeland at wikimedia

Aug 31, 2012, 10:13 AM

Post #4 of 4 (447 views)
Permalink
Re: MediaWiki security release: 1.19.2 and 1.18.5 [In reply to]

Thanks, Chris.

What's the reason for releasing before adding code to git?

Correct me if I'm wrong, but were the point releases and the
announcements also made before the fixes for the vulnerabilities hit
master? If so, are you sure that's a good idea?

On Fri, Aug 31, 2012 at 7:07 PM, Chris Steipp <csteipp [at] wikimedia> wrote:
> REL1_19 is merged and tagged now. Apologies for the delay.
>
> I'm still working on getting REL1_18 finished.
>
> On Fri, Aug 31, 2012 at 3:59 AM, Niklas Laxstrm
> <niklas.laxstrom [at] gmail> wrote:
>> On 31 August 2012 07:55, Chris Steipp <csteipp [at] wikimedia> wrote:
>>> I would like to announce the release of MediaWiki 1.19.2 and 1.18.5.
>>> These releases fix 6 security related bugs that could affect users of
>>> MediaWiki. Download links are given at the end of this email.
>>
>> I don't see updates in git REL1_19 branch nor does tag 1.19.2 exist.
>> Same probably applies to 1.18.

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l

Wikipedia wikitech RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.