This is an announcement of a security release of the
LdapAuthentication plugin. This release adds support for the fix
released in MediaWiki core in versions 1.19.2 and 1.18.5 that involved
data leakage, and false authentication in situations where the
LdapAuthentication extension was returning strict() as false.
The commit for this fix is: e67d0d392d261aa5a6b59f61dae4c42119aef2e3
The change-id in Gerrit is: I5244af48b895ebfb7ca79f04019924a172c417e4
It's also tagged in the git repo as 2.0c.
Additionally, after upgrading MediaWiki and the LdapAuthentication
extension, you should also purge leaked passwords from your local
database. Please see bug 39184
<https://bugzilla.wikimedia.org/show_bug.cgi?id=39184> for information
regarding purging the passwords.
- Ryan Lane