ALT-BU-2022-5295-1
Branch sisyphus_mipsel update bulletin.
Package mediawiki updated to version 1.37.2-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-28201
An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message.
- https://blog.legoktm.com/2022/07/03/a-belated-writeup-of-cve-2022-28201-in-mediawiki.html
- https://blog.legoktm.com/2022/07/03/a-belated-writeup-of-cve-2022-28201-in-mediawiki.html
- [debian-lts-announce] 20220922 [SECURITY] [DLA 3117-1] mediawiki security update
- [debian-lts-announce] 20220922 [SECURITY] [DLA 3117-1] mediawiki security update
- https://phabricator.wikimedia.org/T297571
- https://phabricator.wikimedia.org/T297571
- DSA-5246
- DSA-5246
Modified: 2024-11-21
CVE-2022-28202
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
- [debian-lts-announce] 20220922 [SECURITY] [DLA 3117-1] mediawiki security update
- [debian-lts-announce] 20220922 [SECURITY] [DLA 3117-1] mediawiki security update
- FEDORA-2022-69bc42d6cf
- FEDORA-2022-69bc42d6cf
- https://phabricator.wikimedia.org/T297543
- https://phabricator.wikimedia.org/T297543
- GLSA-202305-24
- GLSA-202305-24
- DSA-5246
- DSA-5246
Modified: 2024-11-21
CVE-2022-28203
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.
Modified: 2024-11-21
CVE-2022-28204
A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere&target=Property%3AP31&namespace=1&invert=1 can take more than thirty seconds. There is a DDoS risk.
Modified: 2024-11-21
CVE-2022-28205
An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future.
Modified: 2024-11-21
CVE-2022-28206
An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rights.
Modified: 2024-11-21
CVE-2022-28209
An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect.