Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 745438 (CVE-2020-25812, CVE-2020-25813, CVE-2020-25815, CVE-2020-25827, CVE-2020-25828, CVE-2020-25869) - <www-apps/mediawiki-1.34.4: Multiple vulnerabilities (CVE-2020-{25812,25813,25815,25827,25828,25869})
Summary: <www-apps/mediawiki-1.34.4: Multiple vulnerabilities (CVE-2020-{25812,25813,2...
Status: RESOLVED FIXED
Alias: CVE-2020-25812, CVE-2020-25813, CVE-2020-25815, CVE-2020-25827, CVE-2020-25828, CVE-2020-25869
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://lists.wikimedia.org/pipermail...
Whiteboard: B4 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2020-09-29 14:57 UTC by Sam James
Modified: 2021-02-20 19:38 UTC (History)
2 users (show)

See Also:
Package list:
www-apps/mediawiki-1.34.4
Runtime testing required: ---
nattka: sanity-check-

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-09-29 14:57:15 UTC 
* (T232568, CVE-2020-25813) SECURITY: SpecialUserrights: If a viewer lacks
`hideuser`, ignore hidden users.
* (T255918, CVE-2020-25812) SECURITY: Unescaped message used in HTML on
Special:Contributions.
* (T256171, CVE-2020-25815) SECURITY: Unescaped message used in HTML within
LogEventsList.
* (T258763, CVE-2020-17367, CVE-2020-17368) SECURITY: Prevent invoking
firejail's --output functionality.
* (T86738, CVE-2020-25814) SECURITY: mediawiki.jqueryMsg: Sanitize URLs and
'style' attribute.
* (T115888, CVE-2020-25828) SECURITY: mediawiki.js: Escape HTML in
mw.message( ... ).parse().
* (T260485, CVE-2020-25869) SECURITY: ActorMigration: Load user from the
correct database.
* (T260485, CVE-2020-25869) SECURITY: ensure actor ID from correct wiki is
used.
* (T251661, CVE-2020-25827) SECURITY: TOTP throttle not enforced cross-wiki.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-09-29 14:59:04 UTC 
Ready?
Comment 2 Miroslav Šulc gentoo-dev 2020-09-29 15:02:38 UTC 
yes
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-10-03 17:10:06 UTC 
ppc stable
Comment 4 Agostino Sarubbo gentoo-dev 2020-10-07 07:11:00 UTC 
x86 stable
Comment 5 Agostino Sarubbo gentoo-dev 2020-10-09 08:33:00 UTC 
amd64 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 6 Larry the Git Cow gentoo-dev 2020-10-09 11:52:12 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d0b4ec45bfca69e7a9ef9d1ae5cf32bf051b1724

commit d0b4ec45bfca69e7a9ef9d1ae5cf32bf051b1724
Author:     Miroslav Šulc <fordfrog@gentoo.org>
AuthorDate: 2020-10-09 11:51:59 +0000
Commit:     Miroslav Šulc <fordfrog@gentoo.org>
CommitDate: 2020-10-09 11:51:59 +0000

    www-apps/mediawiki: removed obsolete and vulnerable 1.34.2
    
    Bug: https://bugs.gentoo.org/745438
    Package-Manager: Portage-3.0.8, Repoman-3.0.1
    Signed-off-by: Miroslav Šulc <fordfrog@gentoo.org>

 www-apps/mediawiki/Manifest                |  1 -
 www-apps/mediawiki/mediawiki-1.34.2.ebuild | 86 ------------------------------
 2 files changed, 87 deletions(-)
Comment 7 NATTkA bot gentoo-dev 2020-11-13 08:41:16 UTC 
Unable to check for sanity:

> no match for package: www-apps/mediawiki-1.34.4
Comment 8 Thomas Deutschmann (RETIRED) gentoo-dev 2021-02-20 19:38:13 UTC 
GLSA Vote: No

Repository is clean, all done!