Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 716752 (CVE-2020-10959, CVE-2020-10960) - <www-apps/mediawiki-1.34.1: Multiple vulnerabilities (CVE-2020-{10959,10960})
Summary: <www-apps/mediawiki-1.34.1: Multiple vulnerabilities (CVE-2020-{10959,10960})
Status: RESOLVED FIXED
Alias: CVE-2020-10959, CVE-2020-10960
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B4 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2020-04-09 04:24 UTC by Sam James
Modified: 2020-06-20 00:47 UTC (History)
2 users (show)

See Also:
Package list:
=www-apps/mediawiki-1.34.1 amd64 ppc x86
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-09 04:24:15 UTC 
1) CVE-2020-10960

Description:
"In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting (XSS)."

"SECURITY: jquery.makeCollapsible allows applying event handler to any CSS selector."

Bug: https://phabricator.wikimedia.org/T246602

2) CVE-2020-10959

Description:
"User content can redirect the logout button to different URL"

Bug: https://phabricator.wikimedia.org/T232932


3) XSS on Special:UserRights

Description:
"SECURITY: Fix HTML escaping in UserGroupMembership::getLink()."

Bug: https://phabricator.wikimedia.org/T236509
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-09 04:26:10 UTC 
@maintainer(s), please advise if ready for stabilisation, or call yourself.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-09 04:40:52 UTC 
Thanks!
Comment 3 Agostino Sarubbo gentoo-dev 2020-04-09 12:25:49 UTC 
amd64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2020-04-11 16:00:29 UTC 
ppc stable
Comment 5 Agostino Sarubbo gentoo-dev 2020-04-11 16:13:04 UTC 
x86 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 6 Larry the Git Cow gentoo-dev 2020-04-12 04:38:10 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3aab280b1d8d344e9067c17352eab7c2bad5cdca

commit 3aab280b1d8d344e9067c17352eab7c2bad5cdca
Author:     Miroslav Šulc <fordfrog@gentoo.org>
AuthorDate: 2020-04-12 04:37:49 +0000
Commit:     Miroslav Šulc <fordfrog@gentoo.org>
CommitDate: 2020-04-12 04:37:49 +0000

    www-apps/mediawiki: removed old vulnerable 1.34.0
    
    Bug: https://bugs.gentoo.org/716752
    Package-Manager: Portage-2.3.98, Repoman-2.3.22
    Signed-off-by: Miroslav Šulc <fordfrog@gentoo.org>

 www-apps/mediawiki/Manifest                |  1 -
 www-apps/mediawiki/mediawiki-1.34.0.ebuild | 79 ------------------------------
 2 files changed, 80 deletions(-)
Comment 7 NATTkA bot gentoo-dev 2020-04-12 19:20:50 UTC 
Resetting sanity check; package list is empty or all packages are done.
Comment 8 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-16 21:42:17 UTC 
I think we can classify these as XSS, so noglsa.

@robbat2, can you verify wiki.*'s fork isn't vulnerable to these?