From WordPress upstream v3.5.1 advisory [1]: * A server-side request forgery vulnerability and remote port scanning using pingbacks. This vulnerability, which could potentially be used to expose information and compromise a site, affects all previous WordPress versions. This was fixed by the WordPress security team. We’d like to thank security researchers Gennady Kovshenin and Ryan Dewhurst for reviewing our work. References: [1] http://wordpress.org/news/2013/01/wordpress-3-5-1/ [2] http://www.openwall.com/lists/oss-security/2013/01/25/7
This issue affects the versions of the wordpress package, as shipped with Fedora release of 16, 17, and 18. Please schedule an update. -- This issue affects the versions of the wordpress package, as shipped with Fedora EPEL 5 and Fedora EPEL 6. Please schedule an update.
Created wordpress tracking bugs for this issue Affects: fedora-all [bug 904124] Affects: epel-all [bug 904125]
*** Bug 904276 has been marked as a duplicate of this bug. ***
The CVE identifier of CVE-2013-0235 has been assigned to this issue: http://www.openwall.com/lists/oss-security/2013/01/29/7
Further references: http://core.trac.wordpress.org/changeset/23330 http://www.acunetix.com/blog/web-security-zone/wordpress-pingback-vulnerability/
wordpress-3.5.1-1.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
wordpress-3.5.1-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
wordpress-3.5.1-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
wordpress-3.5.1-2.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.