Bug 853442 (CVE-2012-4381) - CVE-2012-4381 mediawiki: Password saved always to the local MediaWiki database and possibility to use old passwords for non-existing accounts in the external auth system
Summary: CVE-2012-4381 mediawiki: Password saved always to the local MediaWiki databas...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-4381
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 853446 853447
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-08-31 14:13 UTC by Jan Lieskovsky
Modified: 2021-10-19 21:56 UTC (History)
2 users (show)

Fixed In Version: mediawiki 1.19.2, mediawiki 1.18.5
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-19 21:56:41 UTC

Attachments (Terms of Use)

Description Jan Lieskovsky 2012-08-31 14:13:37 UTC 
A security flaw was found in the way MediaWiki, a wiki engine, performed passwords management:
1) user passwords were always saved to the local MediaWiki database (regardless of external authentication extension being in use or not),
2) also previously it was possible to use old passwords for accounts non-existing in the external authentication system indefinitely.

References:
[1] http://www.gossamer-threads.com/lists/wiki/mediawiki/295767

Upstream bug:
[2] https://bugzilla.wikimedia.org/show_bug.cgi?id=39184

Upstream patch:
[3] https://bugzilla.wikimedia.org/show_bug.cgi?id=39184#c1
Comment 1 Jan Lieskovsky 2012-08-31 14:15:12 UTC 
This issue affects the versions of the mediawiki package, as shipped with Fedora release of 16 and 17. Please schedule an update.

--

This issue affects the version of the mediawiki package, as shipped with Fedora EPEL 5. Please schedule an update.
Comment 2 Jan Lieskovsky 2012-08-31 14:37:37 UTC 
CVE request:
http://www.openwall.com/lists/oss-security/2012/08/31/6
Comment 3 Jan Lieskovsky 2012-08-31 14:41:07 UTC 
Created mediawiki tracking bugs for this issue

Affects: fedora-all [bug 853446]
Comment 4 Jan Lieskovsky 2012-08-31 14:43:01 UTC 
Created mediawiki tracking bugs for this issue

Affects: epel-5 [bug 853447]
Comment 5 Jan Lieskovsky 2012-09-03 08:23:41 UTC 
The CVE identifier of CVE-2012-4381 has been assigned to the "Password saved always to the local MediaWiki database" issue:
http://www.openwall.com/lists/oss-security/2012/08/31/10
Note You need to log in before you can comment on or make changes to this bug.