MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

1 participants
334 discussions

Security pre-release announcement: 1.31.7 / 1.33.3 / 1.34.1
by Sam Reed 25 Mar '20

25 Mar '20

Hi all, Tomorrow we will be issuing a security and maintenance release to all supported branches of MediaWiki. The new releases will be: - 1.34.1 - 1.33.3 - 1.31.7 This will resolve two minor issues in MediaWiki core, and also includes some fixes previously committed to git, including minor security and hardening patches along with bug fixes included for maintenance reasons. We've noted that these issues are minor, and as such you don't need to apply them as quickly as with other security releases, if you're unable to do so. We therefore decided to continue with getting the security (and maintenance) release out for this quarter as planned, even with the global situation as is. We will make the fixes available in these respective release branches, and also master. Tarballs will be available for the above mentioned point releases as well. A summary of some of the security fixes that have gone into non bundled MediaWiki extensions will also follow. Thanks! Sam

1 0

MediaWiki 1.32 is End of Life
by Sam Reed 23 Jan '20

23 Jan '20

As per the MediaWiki version life cycle [1], I would like to announce the formal end of life (EOL) of MediaWiki 1.32 as of tomorrow, Friday January 24, 2019. This means that MediaWiki 1.32 will no longer receive maintenance or security backports. It is therefore strongly discouraged that you continue to use it. It is recommended to upgrade to MediaWiki 1.34 (due to become EOL in November 2020), or less preferably to MediaWiki 1.33 (due to become EOL in June 2020). The current Long Term Support (LTS) version of MediaWiki, MediaWiki 1.31, is older (and downgrading is not supported), though the next LTS (MediaWiki 1.35) is due to be released in June 2020, and will be supported until June 2023. MediaWiki 1.33 has the same supported PHP version of 7.0 (which is itself unsupported upstream), in case you need longer to upgrade your systems. MediaWiki 1.34 requires PHP 7.2.9 or later. Thanks! Sam Reed [1] https://www.mediawiki.org/wiki/Version_lifecycle

1 0

MediaWiki Extensions and Skins Security Release Supplement
by Scott Bassett 19 Dec '19

19 Dec '19

Greetings- With the security/maintenance release of MediaWiki 1.31.6/1.32.6/1.33.2 [0], we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: == CheckUser == + (T234862, CVE-2019-18611) - Do not show oversighted edit summaries in CheckUser API <https://gerrit.wikimedia.org/r/q/Ie0aa0df2b3f03d8b910733f1b5e600a0dc978765> == AbuseFilter == + (T104807, CVE-2019-18612) - Older hidden versions of a currently-public AbuseFilter are exposed via diffs <https://gerrit.wikimedia.org/r/q/Ie23e8234ae550273bf3f6f9c5ac45b7fc54eec2a> + (T237887, CVE-2019-18987) - Old public versions of private filters are publicly viewable <https://gerrit.wikimedia.org/r/q/Ic12790bd33982473f77551bde9599ed083a3e1f1> == VisualEditor == + (T239209, CVE-2019-19708) - XSS in Visual Editor via Copy&Paste <https://gerrit.wikimedia.org/r/q/I1f99458fd2c4f6b2460dfe7a93b330ddee4400b6> == MinervaNeue skin == + (T240487, CVE requested) - XSS in MinervaNeue skin <https://gerrit.wikimedia.org/r/q/Ida471291f1698387a26736931ab17e6899e05b51> == LDAPAuthentication2 == + (T240338, No CVE requested) - LDAPAuthentication2 allows login with invalid password <https://gerrit.wikimedia.org/r/q/I7b125ab468ebc914b8a1c67ed0c03e3c2a20c6cd> The Wikimedia Security Team recommends updating these extensions and skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [0] https://lists.wikimedia.org/pipermail/wikitech-l/2019-December/092886.html [1] https://phabricator.wikimedia.org/T234983 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs -- Scott Bassett sbassett(a)wikimedia.org

1 0

Security and maintenance release: 1.31.6 / 1.32.6 / 1.33.12
by Sam Reed 19 Dec '19

19 Dec '19

1 0

Announcing MediaWiki 1.34.0
by Sam Reed 19 Dec '19

19 Dec '19

I am happy to announce the availability of the general release of MediaWiki 1.34! While tarballs have already been uploaded, git tags will follow later on today. Thanks to everyone who helped out with this release, especially thanks to those who tested out the release candidates and provided feedback, as well as the developers who worked hard to get several important fixes merged in time for the 1.34 final release. To see what's changed in 1.34, see the release notes below. Please note that MediaWiki 1.34 no longer supports HHVM, and also the PHP version requirement has been raised from 7.0.13 in MediaWiki 1.33, to 7.2.9. As per the pre-release announcement, 1.34.0 includes some security fixes that weren't in 1.34.0-rc.0 or 1.34.0-rc.1. == Security fixes == * (T192134) Personal and site-wide CSS and JavaScript is loaded on Special:PasswordReset. * (T239466) Possible to circumvent title-blacklist (CVE-2019-19709). == Links to all mentioned tasks == * https://phabricator.wikimedia.org/T192134 * https://phabricator.wikimedia.org/T239466 MediaWiki 1.34 is due to be supported until the end of November 2020. ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0.tar.gz Patch to previous version (1.34.0-rc.1): https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0.tar.gz.… https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html Release Notes https://www.mediawiki.org/wiki/Release_notes/1.34

1 0

Security pre-release announcement: 1.30.6 / 1.32.6 / 1.33.2 / 1.34.0
by Sam Reed 18 Dec '19

18 Dec '19

Hi all, Tomorrow we will be issuing a security and maintenance release to all supported branches of MediaWiki. It will also coincide with the with formal release of 1.34.0, which has been a little bit delayed due to the US holidays and the Wikimedia Technical Conference whilst the last few couple of outstanding issues could be fixed. It also meant that a followup release to the REL1_34 branch wouldn't be needed only a couple of weeks after the 1.34.0 release was cut. The new releases will be: 1.34.0 1.33.2 1.32.6 1.31.6 This will resolve 1 issue in MediaWiki core (when running on older PHP versions), and also includes some fixes previously committed to git, such as minor security and hardening patches. Fixes will be available in these respective release branches, and also master. Tarballs will be available for the above mentioned point releases as well. 1.32.6 will also be the final release for 1.32 (barring any unforeseen issues), which is scheduled to become end of life in January 2020 [1]. If you're using 1.32, it is recommended that you upgrade to the latest point release of the 1.33 branch (1.33.2, to be released tomorrow) or 1.34.0 to carry on using a maintained and supported release. This security release includes fixes for MediaWiki core. A summary of some of the security fixes that have gone into non bundled MediaWiki extensions will also follow. [1] https://www.mediawiki.org/wiki/Version_lifecycle Thanks! Sam

1 0

MediaWiki 1.34.0-rc.1 is ready for testing
by Sam Reed 05 Nov '19

05 Nov '19

I'm pleased to announce the immediate availability of MediaWiki 1.34.0-rc.1, the first second candidate for 1.34.x. Download links at the end of the e-mail. The tag has been signed and pushed to Git. Please note that MediaWiki 1.34 no longer supports HHVM, and also the PHP version requirement has been raised from 7.0.13 in MediaWiki 1.33, to 7.2.9. This is not a final release and should not be used for production websites. Known issues are tracked in Phabricator on the release workboard [1]. As always please do try out the release candidate in a test environment and report any issues that you discover. Please use the #MW-1.34-Release [2] tag in Phabricator when reporting issues specific to this release. MediaWiki 1.34.0-rc.1 reverts some deprecations in the Parser code that were reported for not properly following our deprecation policy. There is a known and intermittent issue that surfaces itself as "Circular dependency when creating service!", see T231866 [3] for more information. If you experience this issue, please let us know (on the ticket) to get an idea of how prevalent it is. It is intended to get this resolved for 1.34.0. It is expected that MediaWiki 1.34 will become final in the second half of November 2019. Preliminary release notes: https://phabricator.wikimedia.org/source/mediawiki/browse/REL1_34/RELEASE-N… https://www.mediawiki.org/wiki/Release_notes/1.34 MediaWiki core with bundled extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0-rc.1.tar.gz Core only, no extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0-rc.1.ta… GPG signatures: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0-rc.1.ta… https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0-rc.1.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html Open Bugs: [1] https://phabricator.wikimedia.org/project/board/3386/ Bug report form: [2] https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.34-… [3] https://phabricator.wikimedia.org/T231866 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0-rc.1.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0-rc.1.ta… GPG signatures: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0-rc.1.ta… https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0-rc.1.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html

1 0

MediaWiki 1.34.0-rc.0 is ready for testing
by Sam Reed 15 Oct '19

15 Oct '19

I'm pleased to announce the immediate availability of MediaWiki 1.34.0-rc.0, the first release candidate for 1.34.x. Download links at the end of the e-mail. The tag has been signed and pushed to Git. Please note that MediaWiki 1.34 no longer supports HHVM, and also the PHP version requirement has been raised from 7.0.13 in MediaWiki 1.33, to 7.2.9. This is not a final release and should not be used for production websites. Known issues are tracked in Phabricator on the release workboard [1]. As always please do try out the release candidate in a test environment and report any issues that you discover. Please use the #MW-1.34-Release [2] tag in Phabricator when reporting issues specific to this release. It is expected that MediaWiki 1.34 will become final in the second half of November 2019. Preliminary release notes: https://phabricator.wikimedia.org/source/mediawiki/browse/REL1_34/RELEASE-N… https://www.mediawiki.org/wiki/Release_notes/1.34 MediaWiki core with bundled extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0-rc.0.tar.gz Core only, no extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0-rc.0.ta… GPG signatures: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0-rc.0.ta… https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0-rc.0.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html Open Bugs: [1] https://phabricator.wikimedia.org/project/board/3386/ Bug report form: [2] https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.34-… ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0-rc.0.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0-rc.0.ta… GPG signatures: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0-rc.0.ta… https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0-rc.0.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html

1 0

Maintenance release: 1.31.5 and 1.32.5
by Sam Reed 15 Oct '19

15 Oct '19

Hi all, I would like to announce the release of MediaWiki 1.32.5 and 1.31.5. These releases primarily fix an issue in the backported security patch for T230402. This wasn't compatible with 1.32 and 1.31 as is, so modifications were required. It was fine for 1.33, hence no followup release for 1.33. Some other minor fixes are also included. == Links to all mentioned tasks == * https://phabricator.wikimedia.org/T230402 == Release notes == Full release notes for 1.31.5: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_31/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.31 Full release notes for 1.32.5: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_32/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.32 For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.32/mediawiki-1.32.5.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.32/mediawiki-core-1.32.5.tar.gz Patch to previous version (1.32.4): https://releases.wikimedia.org/mediawiki/1.32/mediawiki-1.32.5.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.32/mediawiki-core-1.32.5.tar.gz.… https://releases.wikimedia.org/mediawiki/1.32/mediawiki-1.32.5.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.32/mediawiki-1.32.5.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.5.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.5.tar.gz Patch to previous version (1.31.4): https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.5.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.5.tar.gz.… https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.5.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.5.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html

1 0

MediaWiki Extensions Security Release Supplement
by Scott Bassett 11 Oct '19

11 Oct '19

Greetings- With the security/maintenance release of MediaWiki 1.31.4 / 1.32.4 / 1.33.1 [0], we would also like to provide this supplementary announcement of wmf-deployed extensions [1] with now-public security patches and backports [2]: == MobileFrontend == * (T229541, CVE-2019-14807) - Javascript injection in edit summary on mobile site. <https://gerrit.wikimedia.org/r/q/I0cb918f8148d1782882e104d127f08cbfa23e542> * (T230576, CVE-2019-15124) - XSS in edit summary for ex:MobileFrontend Special:Watchlist <https://gerrit.wikimedia.org/r/q/If4e91093c676de3391e6dde415c8c91c1f582998> == CheckUser == * (T207094 [task to remain private], CVE-2019-16529) - Oversighted edit summaries still visible in CheckUser results <https://gerrit.wikimedia.org/r/q/I3d28bd9f14c1237a34afcd2e4479152f571e29a6> == AbuseFilter == * (T224203 [task to remain private], CVE-2019-16528) - Oversighting the user who performed an edit doesn't hide it from the abuse filter log <https://gerrit.wikimedia.org/r/q/If3d3256404d0f3dbde171831937d1a816b3e2734> The Wikimedia Security Team recommends updating these extensions to the current master branch or supported release branches [3] as soon as possible. As you may have noticed, some of the referenced Phabricator tasks above are still private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator. [0] https://lists.wikimedia.org/pipermail/wikitech-l/2019-October/092656.html [1] https://w.wiki/9hi [2] https://phabricator.wikimedia.org/T232113 [3] https://www.mediawiki.org/wiki/Version_lifecycle -- Scott Bassett sbassett(a)wikimedia.org

1 0

← Newer
1
...
7
8
9
10
11
12
13
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce