Bug 958303 (CVE-2013-2031, CVE-2013-2032)

Summary:	CVE-2013-2031 CVE-2013-2032 mediawiki: security releases 1.20.5 and 1.19.6
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	extras-orphan, ian, mike, puiterwijk, smooge, upstream-release-monitoring
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mediawiki 1.20.5, mediawiki 1.19.6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-12-14 16:23:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	953669, 953670, 958306, 958307
Bug Blocks:

Description Vincent Danen 2013-04-30 20:56:10 UTC

Two flaws were corrected in the recently-released MediaWiki 1.20.5 and 1.19.6 releases:

* Jan Schejbal / Hatforce.com reported that SVG script filtering could be bypassed for Chrome and Firefox clients by using an encoding that MediaWiki understood, but these browsers interpreted as UTF-8. [1]

* Internal review discovered that extensions were not given the opportunity to disable a password reset, which could lead to circumvention of two-factor authentication. [2]

[1] https://bugzilla.wikimedia.org/show_bug.cgi?id=47304
[2] https://bugzilla.wikimedia.org/show_bug.cgi?id=46590

Comment 1 Vincent Danen 2013-04-30 20:58:00 UTC

Created mediawiki tracking bugs for this issue

Affects: fedora-all [bug 958306]
Affects: epel-5 [bug 953669]

Comment 2 Vincent Danen 2013-04-30 20:58:03 UTC

Created mediawiki119 tracking bugs for this issue

Affects: epel-6 [bug 958307]

Comment 3 Vincent Danen 2013-04-30 20:58:06 UTC

Created mediawiki116 tracking bugs for this issue

Affects: epel-all [bug 953670]

Comment 4 Vincent Danen 2013-05-01 19:45:13 UTC

*** Bug 958474 has been marked as a duplicate of this bug. ***

Comment 5 Vincent Danen 2013-05-01 19:46:44 UTC

As per http://seclists.org/oss-sec/2013/q2/248 these issues have been assigned CVE-2013-2031 (SVG script filter bypass) and CVE-2013-2032 (circumvention of two-factor authentication).

Comment 6 Fedora Update System 2013-05-17 22:17:54 UTC

mediawiki119-1.19.6-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2013-05-19 02:34:02 UTC

mediawiki-1.19.6-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2013-05-19 02:39:37 UTC

mediawiki-1.19.6-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2013-05-24 20:36:08 UTC

mediawiki-1.20.5-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.