* (bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted namespaces. Also disallow iframe elements. User will get an error including the namespace name if they use a non- whitelisted namespace. * (bug 61346) SECURITY: Make token comparison use constant time. It seems like our token comparison would be vulnerable to timing attacks. This will take constant time. * (bug 61362) SECURITY: API: Don't find links in the middle of api.php links.
I'm actually not sure that these qualify as security issues at our level. Upstream claims that they are though.
*** Bug 504290 has been marked as a duplicate of this bug. ***
Ping, 27 days since release; target delay is 30 days.
Fixed versions already in the tree, but unstable. Arches, please test and stable: =www-apps/mediawiki-{1.19.13,1.21.7} Target arches: amd64 ppc x86
does not make sense stabilize here, since exist bug 506018
CVE-2014-2244 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2244): Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php. CVE-2014-2243 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2243): includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses. CVE-2014-2242 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2242): includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.
GLSA VOTE: YES
GLSA already in progress, adding to existing GLSA
This issue was resolved and addressed in GLSA 201502-04 at http://security.gentoo.org/glsa/glsa-201502-04.xml by GLSA coordinator Kristian Fiskerstrand (K_F).