Bug 716752 (CVE-2020-10959, CVE-2020-10960)

Summary:	<www-apps/mediawiki-1.34.1: Multiple vulnerabilities (CVE-2020-{10959,10960})
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	robbat2, web-apps
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B4 [noglsa cve]
Package list:	=www-apps/mediawiki-1.34.1 amd64 ppc x86	Runtime testing required:	---

Description Sam James archtester

2020-04-09 04:24:15 UTC

1) CVE-2020-10960

Description:
"In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting (XSS)."

"SECURITY: jquery.makeCollapsible allows applying event handler to any CSS selector."

Bug: https://phabricator.wikimedia.org/T246602

2) CVE-2020-10959

Description:
"User content can redirect the logout button to different URL"

Bug: https://phabricator.wikimedia.org/T232932


3) XSS on Special:UserRights

Description:
"SECURITY: Fix HTML escaping in UserGroupMembership::getLink()."

Bug: https://phabricator.wikimedia.org/T236509

Comment 1 Sam James archtester

2020-04-09 04:26:10 UTC

@maintainer(s), please advise if ready for stabilisation, or call yourself.

Comment 2 Sam James archtester

2020-04-09 04:40:52 UTC

Thanks!

Comment 3 Agostino Sarubbo gentoo-dev

2020-04-09 12:25:49 UTC

amd64 stable

Comment 4 Agostino Sarubbo gentoo-dev

2020-04-11 16:00:29 UTC

ppc stable

Comment 5 Agostino Sarubbo gentoo-dev

2020-04-11 16:13:04 UTC

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

Comment 6 Larry the Git Cow gentoo-dev

2020-04-12 04:38:10 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3aab280b1d8d344e9067c17352eab7c2bad5cdca

commit 3aab280b1d8d344e9067c17352eab7c2bad5cdca
Author:     Miroslav Šulc <fordfrog@gentoo.org>
AuthorDate: 2020-04-12 04:37:49 +0000
Commit:     Miroslav Šulc <fordfrog@gentoo.org>
CommitDate: 2020-04-12 04:37:49 +0000

    www-apps/mediawiki: removed old vulnerable 1.34.0
    
    Bug: https://bugs.gentoo.org/716752
    Package-Manager: Portage-2.3.98, Repoman-2.3.22
    Signed-off-by: Miroslav Šulc <fordfrog@gentoo.org>

 www-apps/mediawiki/Manifest                |  1 -
 www-apps/mediawiki/mediawiki-1.34.0.ebuild | 79 ------------------------------
 2 files changed, 80 deletions(-)

Comment 7 NATTkA bot gentoo-dev

2020-04-12 19:20:50 UTC

Resetting sanity check; package list is empty or all packages are done.

Comment 8 Sam James archtester

2020-04-16 21:42:17 UTC

I think we can classify these as XSS, so noglsa.

@robbat2, can you verify wiki.*'s fork isn't vulnerable to these?