<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html><head><meta content="text/html; charset=utf-8" http-equiv="Content-Type"></head> <div style='font-size:10.0pt;font-family:"Tahoma","sans-serif";padding:3.0pt 0in 0in 0in'> <hr style='border:none;border-top:solid #E1E1E1 1.0pt'> From: Chad <innocentkiller@gmail.com> Sent: December 17, 2015 7:25:59 PM EST To: "mediawiki-announce@lists.wikimedia.org" <mediawiki-announce@lists.wikimedia.org> Subject: [MediaWiki-announce] Security Release: 1.26.1, 1.25.4, 1.24.5 and 1.23.12 </div> <pre class="k9mail">I would like to announce the release of MediaWiki 1.26.1, 1.25.4, 1.24.5, and 1.23.12. These releases fix five security issues in core, in addition to other bug fixes. Download links are given at the end of this email == Security fixes == (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths that do not begin with a slash. This enabled trivial XSS attacks. Configuration values such as "<a href="http://my.wiki.com/wiki">http://my.wiki.com/wiki</a>/$1" are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an error (T119309) SECURITY: Use hash_compare() for edit token comparison (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting with '@' as file uploads (T115522) SECURITY: Passwords generated by User::randomPassword() can no longer be shorter than $wgMinimalPasswordLength (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could result in improper blocks being issued (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions and related pages no longer use HTTP redirects and are now redirected by MediaWiki == Note about EOL of 1.24.x == Please note that 1.24.5 marks the end of support for the 1.24.x series of releases. Technically this ended a few weeks ago with the release of 1.26.0 but we dropped one final release of 1.24.x here to give it a nicer send off for those who have not yet upgraded. == Release notes == Full release notes for 1.26.1: <<a href="https://www.mediawiki.org/wiki/Release_notes/1.26">https://www.mediawiki.org/wiki/Release_notes/1.26</a>> Full release notes for 1.25.4: <<a href="https://www.mediawiki.org/wiki/Release_notes/1.25">https://www.mediawiki.org/wiki/Release_notes/1.25</a>> Full release notes for 1.24.5: <<a href="https://www.mediawiki.org/wiki/Release_notes/1.24">https://www.mediawiki.org/wiki/Release_notes/1.24</a>> Full release notes for 1.23.12: <<a href="https://www.mediawiki.org/wiki/Release_notes/1.23">https://www.mediawiki.org/wiki/Release_notes/1.23</a>> For information about how to upgrade, see <<a href="https://www.mediawiki.org/wiki/Manual:Upgrading">https://www.mediawiki.org/wiki/Manual:Upgrading</a>> ********************************************************************** 1.26.1 ********************************************************************** Download: <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.tar.gz">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.tar.gz</a> <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.1.tar.gz">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.1.tar.gz</a> Patch to previous version: <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.patch.gz">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.patch.gz</a> <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-i18n-1.26.1.patch.gz">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-i18n-1.26.1.patch.gz</a> GPG signatures: <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.tar.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.patch.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.1.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.1.tar.gz.sig</a> Public keys: <a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a> ********************************************************************** 1.25.4 ********************************************************************** Download: <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.tar.gz">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.tar.gz</a> <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.4.tar.gz">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.4.tar.gz</a> Patch to previous version: <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.patch.gz">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.patch.gz</a> <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.4.patch.gz">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.4.patch.gz</a> GPG signatures: <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.tar.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.patch.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.4.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.4.tar.gz.sig</a> Public keys: <a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a> ********************************************************************** 1.24.5 ********************************************************************** Download: <a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.tar.gz">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.tar.gz</a> <a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.5.tar.gz">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.5.tar.gz</a> Patch to previous version: <a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.patch.gz">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.patch.gz</a> <a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.5.patch.gz">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.5.patch.gz</a> GPG signatures: <a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.tar.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.patch.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.5.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.5.tar.gz.sig</a> Public keys: <a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a> ********************************************************************** 1.23.12 ********************************************************************** Download: <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.tar.gz">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.tar.gz</a> <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.12.tar.gz">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.12.tar.gz</a> Patch to previous version: <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.patch.gz">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.patch.gz</a> <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.12.patch.gz">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.12.patch.gz</a> GPG signatures: <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.tar.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.patch.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.12.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.12.tar.gz.sig</a> Public keys: <a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a> -Chad H. & Chris S. <hr /> MediaWiki announcements mailing list To unsubscribe, go to: <a href="https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce">https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce</a> </pre> -- Sent from my Android device with K-9 Mail. Please excuse my brevity.</html>