I would like to announce the release of MediaWiki 1.21.2, 1.20.7 and 1.19.8. These releases fix 3 security related bugs that could affect users of MediaWiki. Download links are given at the end of this email.
* Mozilla, and other developers, reported a full path disclosure in MediaWiki, when an invalid language is specified in ResourceLoader https://bugzilla.wikimedia.org/show_bug.cgi?id=46332
* An internal review found several API modules allowed anti-CSRF tokens to be accessed via JSONP. https://bugzilla.wikimedia.org/show_bug.cgi?id=49090
* Andreas Peetz reported an issue with the MediaWiki API where an invalid property name could be used for XSS with older versions of Internet Explorer. https://bugzilla.wikimedia.org/show_bug.cgi?id=52746
Additionally, the following extensions have been updated to fix security issues:
* CentralAuth: An internal review found an authentication regression that allowed an attacker to bypass authentication https://bugzilla.wikimedia.org/show_bug.cgi?id=52338
* SyntaxHighlight_GeSHi: Mateusz Goik reported an XSS in the included example.php script https://bugzilla.wikimedia.org/show_bug.cgi?id=49070
* CheckUser: Alex Monk reported and fixed that CheckUser didn't require anti-CSRF tokens for checking users https://bugzilla.wikimedia.org/show_bug.cgi?id=45019
* Wikibase: Liangent reported and fixed an XSS https://bugzilla.wikimedia.org/show_bug.cgi?id=53472
* LiquidThreads: Alex Monk reported and fixed an XSS https://bugzilla.wikimedia.org/show_bug.cgi?id=53320
Full release notes for 1.21.2: https://www.mediawiki.org/wiki/Release_notes/1.21
Full release notes for 1.20.7: https://www.mediawiki.org/wiki/Release_notes/1.20
Full release notes for 1.19.8: https://www.mediawiki.org/wiki/Release_notes/1.19
For information about how to upgrade, see https://www.mediawiki.org/wiki/Manual:Upgrading
********************************************************************** 1.21.2 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.2.tar.gz
Patch to previous version (1.21.1): http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.2.patch.gz
GPG signatures: http://download.wikimedia.org/mediawiki/1.21/mediawiki-core-1.21.2.tar.gz.si... http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.2.patch.gz.sig
Public keys: https://www.mediawiki.org/keys/keys.html
********************************************************************** 1.20.7 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.7.tar.gz
Patch to previous version (1.20.6): http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.7.patch.gz
GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-core-1.20.7.tar.gz.si... http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.7.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.7.patch.gz.sig
Public keys: https://www.mediawiki.org/keys/keys.html
********************************************************************** 1.19.8 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.8.tar.gz
Patch to previous version (1.19.7): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.8.patch.gz
GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.8.tar.gz.si... http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.8.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.8.patch.gz.sig
Public keys: https://www.mediawiki.org/keys/keys.html
********************************************************************** Extension:CentralAuth ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CentralAuth
********************************************************************** Extension:SyntaxHighlight_GeSHi ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:SyntaxHighlight_GeSHi
********************************************************************** Extension:CheckUser ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CheckUser
********************************************************************** Extension:Wikibase ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Wikibase
********************************************************************** Extension:LiquidThreads ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:LiquidThreads