Bug 1634161 (CVE-2018-0503)

Summary:	CVE-2018-0503 mediawiki: $wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ahardin, aos-bugs, Axel.Thimm, bleanhar, bmontgom, ccoleman, dedgar, eparis, gwync, jburrell, jgoulding, jokerman, mchappel, mike, nstielau, puiterwijk, shurley, sponnaga
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mediawiki 1.31.1, mediawiki 1.30.1, mediawiki 1.29.3, mediawiki 1.27.5	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-10-18 06:51:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1634162, 1710098, 1734829, 1734830, 1742212, 1742213
Bug Blocks:	1634171

Description Pedro Sampaio 2018-09-28 20:27:04 UTC

As reported:

Contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'.

For example, with the following configuration, newly registered accounts are able to edit 10 pages per hour instead of 5:

$wgRateLimits[ 'edit' ] = [
  'user' => [ 10, 60*60 ],
  'newbie' => [ 5, 60*60 ],
];

This seems to be the opposite of what documentation in DefaultSettings.php says:

'newbie' => [ x, y ], // each new autoconfirmed accounts; overrides 'user'

(although that should probably be 'non-autoconfirmed'…).

Upstream bug:

https://phabricator.wikimedia.org/T169545

References:

https://lists.wikimedia.org/pipermail/mediawiki-announce/2018-September/000223.html

Comment 1 Pedro Sampaio 2018-09-28 20:28:15 UTC

Created mediawiki tracking bugs for this issue:

Affects: fedora-all [bug 1634162]

Comment 3 Dave Baker 2019-05-14 21:02:51 UTC

Updating affected products; mediawiki-123 is the container name, mediawiki123 is the package name.

Comment 5 Dave Baker 2019-07-31 14:50:14 UTC

I'm not sure why I didn't file bugs against 3.9 and 3.10 earlier.  I confirmed the latest tagged containers are still affected and am filing those trackers not.

(3.6 and 3.7 went EOL, so those are just being marked as such)

Comment 8 errata-xmlrpc 2019-10-18 01:31:01 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.11

Via RHSA-2019:3142 https://access.redhat.com/errata/RHSA-2019:3142

Comment 9 Product Security DevOps Team 2019-10-18 06:51:19 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-0503

Comment 10 errata-xmlrpc 2019-10-29 16:09:14 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.10

Via RHSA-2019:3238 https://access.redhat.com/errata/RHSA-2019:3238

Comment 11 errata-xmlrpc 2019-11-07 16:54:00 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.9

Via RHSA-2019:3813 https://access.redhat.com/errata/RHSA-2019:3813