Bug 1903754 (CVE-2020-26121)

Summary: CVE-2020-26121 mediawiki: attacker can import a file even when the target page is protected against page creation
Product: [Other] Security Response Reporter: Dhananjay Arunesh <darunesh>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aos-bugs, Axel.Thimm, bmontgom, eparis, jburrell, jokerman, mike, nstielau, puiterwijk, shurley, sponnaga
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: mediawiki-1.34.4 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-12-07 17:02:42 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1903755    
Bug Blocks: 1903781    

Description Dhananjay Arunesh 2020-12-02 18:18:32 UTC 
An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against "page creation" and the attacker should not be able to create it. This occurs because of a mishandled distinction between an upload restriction and a create restriction. An attacker cannot leverage this to overwrite anything, but can leverage this to force a wiki to have a page with a disallowed title.

References:
https://commons.wikimedia.org/w/index.php?oldid=454609892#File:Wiki.png
https://gerrit.wikimedia.org/r/q/Ib852a96afc4dca10516d0510e69c10f9892b351b
https://phabricator.wikimedia.org/T262628
Comment 1 Dhananjay Arunesh 2020-12-02 18:19:22 UTC 
Created mediawiki tracking bugs for this issue:

Affects: fedora-all [bug 1903755]
Comment 2 Przemyslaw Roguski 2020-12-07 14:48:27 UTC 
The vulnerability is directly related to FileImporter Extension, which is not bundled in the OpenShift mediawiki package.
Comment 4 Przemyslaw Roguski 2020-12-07 14:48:33 UTC 
External References:

https://phabricator.wikimedia.org/T262628
Comment 5 Przemyslaw Roguski 2020-12-07 16:49:05 UTC 
Statement:

OpenShift Container Platform (OCP)  delivers the mediawiki package, but the vulnerable code is not bundled, therefore OCP is not affected by this flaw.
Comment 6 Product Security DevOps Team 2020-12-07 17:02:42 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-26121