MediaWiki-announce May 2024

mediawiki-announce@lists.wikimedia.org

1 participants
1 discussions

MediaWiki Extensions and Skins Security Release Supplement (1.39.7/1.40.3/1.41.1)

by Maryum Styles

Greetings- There was a delay in CVE assignment due to a backlog with Mitre. With the security/maintenance release of MediaWiki .39.7/1.40.3/1.41.1, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: CheckUser + (T355434, CVE-2024-34505) - Temporary account IP reveal does not check the deleted status https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/992795/ CheckUser + (T356226, CVE-2024-34501) - CheckUser Client Hints REST API does not use a CSRF token https://gerrit.wikimedia.org/r/q/Idc776c7c7612c8b9e2c134706c9e2ebc2f5b655f ReportIncident + (T356190, CVE-2024-34503) - ReportIncident REST API does not use a CSRF token https://gerrit.wikimedia.org/r/q/I27b5899cf69837c9ab8fee2b5bc9b2e788e69f9e IPInfo + (T356183, CVE-2024-34504) - IPInfo REST APIs are not safe from CSRF attacks https://gerrit.wikimedia.org/r/q/I5974c1e71286f5f920ace51ba064e96c88296a4e WikiDiscover + (GHSA-cfcf-94jv-455f, CVE-2024-25107) - Cross-Site Scripting on Special:WikiDiscover https://github.com/miraheze/WikiDiscover/security/advisories/GHSA-cfcf-94jv… UnlinkedWikibase + (T357203, CVE-2024-34500) - XSS through interface message in UnlinkedWikibase https://gerrit.wikimedia.org/r/c/mediawiki/extensions/UnlinkedWikibase/+/10… WikibaseLexeme + (T357101, CVE-2024-34502) - Special:MergeLexemes makes edits on GET requests without edit tokens https://gerrit.wikimedia.org/r/q/Iae0c7c3b979118559c9ce2276618c6cdec11e63d Cargo + (T331362, CVE-2023-29134) - SQL injection in Cargo handling of quotes inside backticks https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1005478 ManageWiki + (GHSA-cfcf-94jv-455f, CVE-2024-25109) - Special:ManageWiki does not escape escape interface messages https://github.com/miraheze/ManageWiki/security/advisories/GHSA-4jr2-jhfm-2… CreateWiki + (GHSA-8wjf-mxjg-j8p9, CVE-2024-29883) - Special:ManageWiki does not escape escape interface messages https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j… [1] https://phabricator.wikimedia.org/T353904 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs

1 week, 2 days

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce May 2024