Michael Brooks has discovered a vulnerability in WordPress, which can be exploited by malicious people to bypass certain security restrictions and to disclose sensitive information. The application does not properly restrict access to posted drafts to users with valid administrator credentials. This can be exploited to read drafts by accessing the index.php script with data in the "PATH_INFO" URL part ending with "wp-admin/". Examples: http://[host]/[path]/index.php/wp-admin/ http://[host]/[path]/index.php/test-wp-admin/ The vulnerability is confirmed in version 2.3.1. Other versions may also be affected. Solution: Do not post sensitive information as drafts. Reproducible: Always
*** Bug 204116 has been marked as a duplicate of this bug. ***
2.3.2 is out; On a side note - dunno folks, but we've had 4 security bugs in two months since this has been unmasked. I really feel that this code is plain hopeless to support security-wise and the ebuild should be re-masked again.
(In reply to comment #2) > On a side note - dunno folks, but we've had 4 security bugs in two months since > this has been unmasked. I really feel that this code is plain hopeless to > support security-wise and the ebuild should be re-masked again. As long as upstream is actively handling vulnerabilities, I think it can stay ~arch with us ensuring fast bumps. What's the point in having this ebuild after all p.masked and security-rotting? Either maintain it (bumping-wise) or kick it.
I know many Gentoo users running this web app in a production environment. Regardless of the number of flaws discovered Wordpress is under active development, and the vulnerabilities are fixed as fast as they can be. I think dropping support would be a disservice to the Gentoo community as well as the OSS community at large. On the other hand, masking it such that users know its a potential security risk is not a bad idea, certainly better than removing it from the tree. Perhaps maintaining it ~ARCH keyworded and adding an einfo statement regarding the history of this software would be apropos as well. Any luck on the new ebuild for 2.3.2? I am willing to test the ebuild on amd64 (hardened and desktop) when its available if it might be of any assistance. Many thanks, Summers
I also feel that keeping it in unstable makes more sense than having it in an masked and unmaintained state. But I added a security warning so that people are able to note the problems we see with this app. Added 2.3.2 to the tree. All archs unstable. Removed insecure versions. webapps done here.
The issues fixed in 2.3.2 are unrelated to CVE-2008-0191.
