Bug 1004538 (CVE-2013-4301, CVE-2013-4302, CVE-2013-4303)

Summary:	CVE-2013-4301 CVE-2013-4302 CVE-2013-4303 mediawiki: security releases 1.21.2, 1.20.7, and 1.19.8
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ago, extras-orphan, gwync, ian, jrusnack, mike, puiterwijk
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mediawiki 1.21.2, mediawiki 1.20.7, mediawiki 1.19.8	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-12-14 17:18:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1004541, 1004542, 1004543
Bug Blocks:

Description Vincent Danen 2013-09-04 21:35:51 UTC

Three flaws were fixed in the recently-released MediaWiki 1.21.2, 1.20.7, and 1.19.8 releases:

* Mozilla, and other developers, reported a full path disclosure in MediaWiki, when an invalid language is specified in ResourceLoader [1]

* An internal review found several API modules allowed anti-CSRF tokens to be accessed via JSONP [2]

* Andreas Peetz reported an issue with the MediaWiki API where an invalid property name could be used for XSS with older versions of Internet Explorer [3]

[1] https://bugzilla.wikimedia.org/show_bug.cgi?id=46332
[2] https://bugzilla.wikimedia.org/show_bug.cgi?id=49090
[3] https://bugzilla.wikimedia.org/show_bug.cgi?id=52746

Comment 1 Vincent Danen 2013-09-04 21:39:49 UTC

Created mediawiki tracking bugs for this issue:

Affects: fedora-all [bug 1004542]

Comment 2 Vincent Danen 2013-09-04 21:40:04 UTC

Created mediawiki119 tracking bugs for this issue:

Affects: fedora-18 [bug 1004541]
Affects: epel-6 [bug 1004543]

Comment 3 Vincent Danen 2013-09-04 22:00:44 UTC

CVE request:

http://www.openwall.com/lists/oss-security/2013/09/04/5

Comment 4 Agostino Sarubbo 2013-09-05 08:35:40 UTC

(In reply to Vincent Danen from comment #3)
> CVE request:
> 
> http://www.openwall.com/lists/oss-security/2013/09/04/5

Assignment:

http://www.openwall.com/lists/oss-security/2013/09/05/5

Comment 5 Dan Mashal 2013-09-05 22:32:22 UTC

Cannot see this affecting EPEL5, to where I have commit rights. So removing myself.

Comment 6 Dan Mashal 2013-09-05 22:32:59 UTC

(please readd me if you want the EPEL5 package updated)

Comment 7 Fedora Update System 2013-09-11 18:09:38 UTC

mediawiki119-1.19.8-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2013-09-20 16:25:26 UTC

mediawiki-1.19.8-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2013-09-20 16:26:35 UTC

mediawiki-1.21.2-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2013-09-23 00:16:52 UTC

mediawiki-1.21.2-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.