Bug 1071139 (CVE-2014-2244)

Summary:	CVE-2014-2244 mediawiki: HTML injection
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	extras-orphan, gwync, ian, mike, puiterwijk
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mediawiki 1.22.3, mediawiki 1.21.6, mediawiki 1.19.13	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-12-14 16:41:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1071142, 1071143, 1071157
Bug Blocks:

Description Murray McAllister 2014-02-28 07:01:34 UTC

The MediaWiki 1.22.3, 1.21.6 and 1.19.12 release announcement notes:

* (bug 61362) SECURITY: API: Don't find links in the middle of api.php links.

An attacker could perform cross-site scripting attacks.

The versions of MediaWiki in Fedora and EPEL 6 are affected. I have not tested EPEL 5.

References:
http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html
https://bugzilla.wikimedia.org/show_bug.cgi?id=61362
https://gerrit.wikimedia.org/r/#/q/Idf985e4e69c2f11778a8a90503914678441cb3fb,n,z

Comment 1 Murray McAllister 2014-02-28 07:09:30 UTC

Created mediawiki tracking bugs for this issue:

Affects: fedora-all [bug 1071142]

Comment 2 Murray McAllister 2014-02-28 07:09:43 UTC

Created mediawiki119 tracking bugs for this issue:

Affects: epel-6 [bug 1071143]

Comment 3 Murray McAllister 2014-02-28 07:21:25 UTC

Created mediawiki tracking bugs for this issue:

Affects: epel-5 [bug 1071157]

Comment 4 Murray McAllister 2014-02-28 07:27:00 UTC

CVE request: http://www.openwall.com/lists/oss-security/2014/02/28/1

Comment 5 Murray McAllister 2014-03-03 02:06:38 UTC

MITRE assigned CVE-2014-2244 to this issue: http://www.openwall.com/lists/oss-security/2014/03/01/2

Comment 6 Fedora Update System 2014-03-11 04:08:47 UTC

mediawiki-1.21.6-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2014-03-11 04:15:00 UTC

mediawiki-1.21.6-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Vincent Danen 2014-03-12 19:24:22 UTC

For the 1.19 branch, this was not properly fixed in 1.19.12 even though it was noted as having been fixed there.  It was actually fixed in 1.19.13 properly.

http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-March/000142.html

This probably will get another CVE assigned by MITRE.

Comment 9 Fedora Update System 2014-04-04 20:30:31 UTC

mediawiki119-1.19.13-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.