December 2021 - MediaWiki-announce - lists.wikimedia.org

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

December

List overview
Download

MediaWiki-announce December 2021

mediawiki-announce@lists.wikimedia.org

1 participants
2 discussions

Start a n N ew thread

Security and maintenance release: 1.35.5 / 1.36.3 / 1.37.1

by Sam Reed

I would like to announce the release of MediaWiki 1.35.5, 1.36.3 and 1.37.1! This release fixes multiple high severity authorization bypasses in MediaWiki core that both allow for reading private wikis and editing arbitrary pages on any wiki. If you do not have time to upgrade right away, please set the following at the bottom of your LocalSettings.php to disable the vulnerable code immediately: $wgActions['mcrundo'] = false; $wgActions['mcrrestore'] = false; $wgWhitelistRead = []; $wgWhitelistReadRegexp = []; This will also work for vulnerable end-of-life MediaWiki versions that do not have a patch available. A more detailed FAQ about these issues is available at https://www.mediawiki.org/wiki/2021-12_security_release/FAQ These releases also serve as a maintenance release for these branches. Note that the patches are much larger than recent previous security and maintenance releases. This is due to the re-introduction of translation backports. These include the export of new languages that have met the translation threshold in the development branch of MediaWiki. These translation updates are for both MediaWiki core and the bundled skins and extensions. In the case of MediaWiki 1.35, this is translation updates going back 18 months, hence the size of the patch. While tarballs have already been uploaded as of this e-mail, git tags will follow later on today. An "MediaWiki Extensions Security Release Supplement" e-mail will follow this one, covering security updates for non-bundled extensions. Finally, a big thanks to all those involved in reporting, investigating and fixing these issues. == Security fixes == * (T292763. CVE-2021-44854) REST API incorrectly publicly caches autocomplete search results from private wikis. * (T271037, CVE-2021-44856) Title blocked in AbuseFilter can be created via Special:ChangeContentModel. * (T297322, CVE-2021-44857) Unauthorized users can use action=mcrundo to replace the content of arbitrary pages. * (T297322, CVE-2021-44858) Unauthorized users can view contents of private wikis using various actions. * (T297574, CVE-2021-45038) Unauthorized users can access private wiki contents using rollback action === Extension security fixes === * (T293589, CVE-2021-44855) Blind Stored XSS in VisualEditor media dialog. * (T294686) Special:Nuke doesn't actually delete pages. == Links to all mentioned tasks == * https://phabricator.wikimedia.org/T294686 * https://phabricator.wikimedia.org/T297322 * https://phabricator.wikimedia.org/T293589 * https://phabricator.wikimedia.org/T292763 * https://phabricator.wikimedia.org/T271037 == Release notes == Full release notes for 1.35.5: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_35/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.35 Full release notes for 1.36.3: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_36/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.36 Full release notes for 1.37.1: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_37/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.37 For information about how to upgrade, see < https://www.mediawiki.org/wiki/Manual:Upgrading > ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.3.tar.gz https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.3.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.3.tar.gz https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.3.zip Patch to previous version (1.36.2): https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.3.patch.gz https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.3.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.3.tar.gz.… https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.3.zip.sig https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.3.zip.sig https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.3.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.3.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.1.tar.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.1.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.1.tar.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.1.zip Patch to previous version (1.37.0): https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.1.patch.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.1.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.1.tar.gz.… https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.1.zip.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.1.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.1.zip.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.1.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.1.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.5.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.5.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.5.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.5.zip Patch to previous version (1.35.4): https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.5.patch.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.5.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.5.tar.gz.… https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.5.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.5.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.5.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.5.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.5.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html

2?years, 5?months

1
0
1 1

Security pre-release announcement: 1.35.5 / 1.36.3 / 1.37.1

by Sam Reed

Hi all, On Wednesday we will be issuing a security and maintenance release to all supported branches of MediaWiki. The new releases will be: - 1.35.5 - 1.36.3 - 1.37.1 This release includes fixes for multiple high severity authorization bypasses in MediaWiki core, it is recommended you patch immediately. A short LocalSettings.php configuration snippet will also be shared to disable the vulnerable functionality if you are unable to patch right away. This snippet should work across all vulnerable MediaWiki versions, including end-of-life ones. In addition to that, this will resolve other issues in MediaWiki core and also includes some fixes previously committed to git, including minor security and hardening patches along with bug fixes included for maintenance reasons. It also fixes 2 issues in MediaWiki tarball bundled extensions. We will make the fixes available in these respective release branches and master. Tarballs will be available for the above mentioned point releases as well. A summary of some of the security fixes that have gone into non-bundled MediaWiki extensions will also follow later.

2?years, 5?months

1
0
0 0