Bug 1004538 (CVE-2013-4301, CVE-2013-4302, CVE-2013-4303)

Summary: CVE-2013-4301 CVE-2013-4302 CVE-2013-4303 mediawiki: security releases 1.21.2, 1.20.7, and 1.19.8
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED RAWHIDE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ago, extras-orphan, ian, jrusnack, limburgher, mike, puiterwijk
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20130903,reported=20130903,source=internet,cvss2=4.3/AV:N/AC:M/Au:N/C:N/I:P/A:N,fedora-18/mediawiki119=affected,fedora-all/mediawiki=affected,epel-5/mediawiki=new,epel-all/mediawiki116=new,epel-6/mediawiki119=affected
Fixed In Version: mediawiki 1.21.2, mediawiki 1.20.7, mediawiki 1.19.8 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-12-14 12:18:46 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1004541, 1004542, 1004543    
Bug Blocks:    

Description Vincent Danen 2013-09-04 17:35:51 EDT
Three flaws were fixed in the recently-released MediaWiki 1.21.2, 1.20.7, and 1.19.8 releases:

* Mozilla, and other developers, reported a full path disclosure in MediaWiki, when an invalid language is specified in ResourceLoader [1]

* An internal review found several API modules allowed anti-CSRF tokens to be accessed via JSONP [2]

* Andreas Peetz reported an issue with the MediaWiki API where an invalid property name could be used for XSS with older versions of Internet Explorer [3]

[1] https://bugzilla.wikimedia.org/show_bug.cgi?id=46332
[2] https://bugzilla.wikimedia.org/show_bug.cgi?id=49090
[3] https://bugzilla.wikimedia.org/show_bug.cgi?id=52746
Comment 1 Vincent Danen 2013-09-04 17:39:49 EDT
Created mediawiki tracking bugs for this issue:

Affects: fedora-all [bug 1004542]
Comment 2 Vincent Danen 2013-09-04 17:40:04 EDT
Created mediawiki119 tracking bugs for this issue:

Affects: fedora-18 [bug 1004541]
Affects: epel-6 [bug 1004543]
Comment 3 Vincent Danen 2013-09-04 18:00:44 EDT
CVE request:

http://www.openwall.com/lists/oss-security/2013/09/04/5
Comment 4 Agostino Sarubbo 2013-09-05 04:35:40 EDT
(In reply to Vincent Danen from comment #3)
> CVE request:
> 
> http://www.openwall.com/lists/oss-security/2013/09/04/5

Assignment:

http://www.openwall.com/lists/oss-security/2013/09/05/5
Comment 5 Dan Mashal 2013-09-05 18:32:22 EDT
Cannot see this affecting EPEL5, to where I have commit rights. So removing myself.
Comment 6 Dan Mashal 2013-09-05 18:32:59 EDT
(please readd me if you want the EPEL5 package updated)
Comment 7 Fedora Update System 2013-09-11 14:09:38 EDT
mediawiki119-1.19.8-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2013-09-20 12:25:26 EDT
mediawiki-1.19.8-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2013-09-20 12:26:35 EDT
mediawiki-1.21.2-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2013-09-22 20:16:52 EDT
mediawiki-1.21.2-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.