MediaWiki-announce August 2012

mediawiki-announce@lists.wikimedia.org

1 participants
1 discussions

MediaWiki security release: 1.19.2 and 1.18.5

by Chris Steipp

I would like to announce the release of MediaWiki 1.19.2 and 1.18.5. These releases fix 6 security related bugs that could affect users of MediaWiki. Download links are given at the end of this email. * Wikipedia administrator Writ Keeper discovered a stored XSS (HTML injection) vulnerability. This was possible due to the handling of link text on File: links for nonexistent files. MediaWiki 1.16 and later is affected. For more details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=39700> * User Fomafix reported several DOM-based XSS vulnerabilities, made possible by a combination of loose filtering of the uselang parameter, and JavaScript gadgets on various language Wikipedias. For more details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=37587> * During internal review, it was discovered that CSRF tokens, available via the api, were not protected with X-Frame-Options headers. This could lead to a CSRF vulnerability if the API response is embedded in an external website using an iframe. For more details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=39180> * During internal review, it was discovered extensions were not always allowed to prevent the account creation action. This allowed users blocked by the GlobalBlocking extension to create accounts. For more details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=39824> * During internal review, it was discovered that password data was always saved to the local MediaWiki database, even if authentication was handled by an extension, such as LDAP. This could allow a compromised MediaWiki installation to leak information about user's LDAP passwords. Additionally, in situations when an authentication plugin returned false in its strict function, this would allow old passwords to be used for accounts that did not exist in the external system, indefinitely. For details on how to clean up the data leakage, see: <https://bugzilla.wikimedia.org/show_bug.cgi?id=39184> * During internal review, it was discovered that metadata about blocks, hidden by a user with suppression rights, was visible to administrators. For more details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=39823> Full release notes for 1.19.2: <https://www.mediawiki.org/wiki/Release_notes/1.19> Full release notes for 1.18.5: <https://www.mediawiki.org/wiki/Release_notes/1.18> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.19.2 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.2.tar.gz Patch to previous version (1.19.1): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.2.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.2.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.18.5 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.5.tar.gz Patch to previous version (1.18.4), without interface text: http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.5.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.18/mediawiki-i18n-1.18.5.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.5.tar.gz.sig http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.5.patch.gz.sig http://download.wikimedia.org/mediawiki/1.18/mediawiki-i18n-1.18.5.patch.gz… Public keys: https://secure.wikimedia.org/keys.html

11 years, 8 months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce August 2012