Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 28 Feb 2014 18:25:22 +1100
From: Murray McAllister <mmcallis@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release

Good morning,

As noted in https://bugs.gentoo.org/show_bug.cgi?id=503012 a few 
security bugs are fixed in the 1.22.3, 1.21.6 and 1.19.12 MediaWiki release:

http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html

Can CVEs be assigned to the following (if they are all CVE worthy)?

https://bugzilla.redhat.com/show_bug.cgi?id=1071135
The MediaWiki 1.22.3, 1.21.6 and 1.19.12 release announcement notes:

* (bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted
   namespaces. Also disallow iframe elements. User will get an error
   including the namespace name if they use a non- whitelisted namespace.

An attacker could perform cross-site scripting attacks by uploading 
crafted SVG images.

The versions of MediaWiki in Fedora and EPEL 6 are affected. I have not 
tested EPEL 5.

References:
http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html
https://bugzilla.wikimedia.org/show_bug.cgi?id=60771
https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb,n,z



https://bugzilla.redhat.com/show_bug.cgi?id=1071136
The MediaWiki 1.22.3, 1.21.6 and 1.19.12 release announcement notes:

* (bug 61346) SECURITY: Make token comparison use constant time. It 
seems like
   our token comparison would be vulnerable to timing attacks. This will 
take
   constant time.

The versions of MediaWiki in Fedora and EPEL 6 are affected. I have not 
tested EPEL 5.

References:
http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html
https://bugzilla.wikimedia.org/show_bug.cgi?id=61346
https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f,n,z



https://bugzilla.redhat.com/show_bug.cgi?id=1071139
The MediaWiki 1.22.3, 1.21.6 and 1.19.12 release announcement notes:

* (bug 61362) SECURITY: API: Don't find links in the middle of api.php 
links.

An attacker could perform cross-site scripting attacks.

The versions of MediaWiki in Fedora and EPEL 6 are affected. I have not 
tested EPEL 5.

References:
http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html
https://bugzilla.wikimedia.org/show_bug.cgi?id=61362
https://gerrit.wikimedia.org/r/#/q/Idf985e4e69c2f11778a8a90503914678441cb3fb,n,z

Thanks,

--
Murray McAllister / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.