MediaWiki-announce August 2016

mediawiki-announce@lists.wikimedia.org

2 participants
4 discussions

Security release addendum - 1.26.4 and 1.23.15
by Chad Horohoe 23 Aug '16

23 Aug '16

Hi, It was pointed out a little while ago that a syntax incompatibility with older versions of PHP affected the 1.26.4 and 1.23.15 releases. This is a minor one line fix, and does not affect those users on PHP 5.4 and above (short arrays). Thanks to Joergi123 for reporting! https://phabricator.wikimedia.org/T143635 Since this mistake did not actually make it into Git and only affected the tarballs, the tags in Git are all correct and I am not issuing a new release. The tarballs have been replaced with corrected versions, links are below for your convenience. ********************************************************************** 1.26.4 ********************************************************************** Download:https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.4.tar… Patch to previous version:https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.4.patc… GPG signatures:https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.4.t… Public keys:https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.23.15 ********************************************************************** Download:https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.15.ta… Patch to previous version:https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.15.pat… GPG signatures:https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.15.… Public keys:https://www.mediawiki.org/keys/keys.html

1 0

Security Release - 1.27.1, 1.26.4, 1.23.15
by Chad Horohoe 23 Aug '16

23 Aug '16

I would like to announce the release of MediaWiki 1.27.1, 1.26.4, 1.23.15! These releases fix five security issues in core and one for the extension PdfHandler. Download links are given at the end of this email. == Security fixes == * (T139565) API: Generate head items in the context of the given title (CVE-2016-6335) * (T137264) XSS in unclosed internal links (CVE-2016-6334) * (T133147) Escape '<' and ']]>' in inline <style> blocks (CVE-2016-6333) * (T133147) Require login to preview user CSS pages (CVE-2016-6333) * (T132926) Do not allow undeleting a revision deleted file if it is the top file (CVE-2016-6336) * (T129738) Make $wgBlockDisablesLogin also restrict logged in permissions (CVE-2016-6332) * (T129738) Make blocks log users out if $wgBlockDisablesLogin is true (CVE-2016-6332) * (T115333) Check read permission when loading page content in ApiParse (CVE-2016-6331) * (T57548) Remove support for $wgWellFormedXml = false, all output is now well formed The following only affects 1.27 and above and is not included in the 1.26 and 1.23 upgrade: * (T139670) Move 'UserGetRights' call before application of Session::getAllowedUserRights() (CVE-2016-6337) The following fix is for the PdfHandler extension: * (T136402) Add -dSAFER to ghostscript as hardening measure == Release notes == Full release notes for 1.27.1: <https://www.mediawiki.org/wiki/Release_notes/1.27> Full release notes for 1.26.4: <https://www.mediawiki.org/wiki/Release_notes/1.26> Full release notes for 1.23.15: <https://www.mediawiki.org/wiki/Release_notes/1.23> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.27.1 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.1.tar.gz https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.1.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.1.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.1.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.1.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.1.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.26.4 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.4.tar.gz https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.4.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.4.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.4.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.4.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.23.15 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.15.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.15.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.15.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.15.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.15.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.15.tar.gz… Public keys: https://www.mediawiki.org/keys/keys.html -Chad H.

1 0

Security Release Pre-Announcement (1.27, 1.26, 1.23)
by Chad Horohoe 19 Aug '16

19 Aug '16

Hi everyone, I would like to give everyone advance notice of a pending security release for all supported branches. The release will come out on Monday, August 22nd. There are several security fixes for core and one extension that will be included in this release, along with the normal backports that have made it into the branches already. The version numbers will be: 1.27.1 1.26.4 1.23.14 Please let me know if you have any other questions. Thanks and have a great weekend. -Chad

1 0

[ConfirmEdit][ReCaptcha] Call-to-Action: ReCaptcha module will be removed in the near future
by Florian Schmidt 04 Aug '16

04 Aug '16

Hi all together, first of all: If you don't use ConfirmEdit with the ReCaptcha (NOT the ReCaptchaNoCaptcha) module, you can STOP reading here :) TL;DR Please upgrade to the ReCaptchaNoCaptcha module to use a supported version in the future and please respond to [1], if you've an opinion about the deprecation/removal plan(s). Long version: As you may know, ConfirmEdit[2] (the MediaWiki extension that helps you to fight against spam) supports different CAPTCHA modules, such as a MathCaptcha (where the user has to solve a math problem) or QuestyCaptcha (where the user has to answer a pre-defined question). Another module is Google's ReCaptcha[3][4], in both versions, the old v1 and the newer v2 (also called NoCaptcha). In December 2014, Google announced a new version of the ReCaptcha CAPTCHA-service, called ReCaptcha NoCaptcha (or ReCaptcha v2). ConfirmEdit currently supports both versions, as Google did the same until recently. Now, as you can read on the FAQ page of ReCaptcha[5], Google stopped supporting the v1 of ReCaptcha. This means, that no new features are developed and that new keys registered for ReCaptcha will work with the new version 2 only. This let me come to the conclusion, that ReCaptcha v1 will not be supported by Google at all anymore in the near future. In order of this, we should ask our self, how long we want to support the old ReCaptcha module in ConfirmEdit (which, compared to the NoCaptcha module, _seems_ to be less effective). The mid-term plan is clear: remove the old ReCaptcha module. Now there are two ways to achieve this: * Deprecate the old reCaptcha in Version 1.27 of MediaWiki (would be a so called backport) and remove it in the upcoming 1.28 release * Deprecate the old reCaptcha in the upcoming Version 1.28 of MediaWiki and remove it: * in MediaWiki 1.29 or * when Google doesn't support the old reCaptcha anymore Because this is a huge problem for existing third-party wikis (and because we don't have any usage statistics), I'm not sure, which plan we should choose. That's why I sent this e-mail out, to get (hopefully) some responses and opinions. So, the call-to-Action: If you still use the old ReCaptcha module, please plan to upgrade to the new version 2 of ReCaptcha as soon as possible and let us know (the best way is a comment in the task[1]), if you need the old ReCaptcha version supported as long as Google supports it, or if you're fine with removing it in the upcoming 1.28 release of MediaWiki. To be absolutely clear: The ReCaptcha module will be removed, the only question is when: in MediaWiki 1.28 or in MediaWiki 1.29. If you've any questions, feel free to answer to this e-mail, add a comment to the linked task, contact me in IRC or write me an e-mail (if you need a private conversation). Thanks for your attention and for using ConfirmEdit! Best, Florian [1] https://phabricator.wikimedia.org/T142133 [2] https://www.mediawiki.org/wiki/Extension:ConfirmEdit [3] https://en.wikipedia.org/wiki/ReCAPTCHA [4] https://www.google.com/recaptcha/intro/index.html [5] https://developers.google.com/recaptcha/docs/faq

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce August 2016