<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html><head><meta content="text/html; charset=utf-8" http-equiv="Content-Type"></head> <div style='font-size:10.0pt;font-family:"Tahoma","sans-serif";padding:3.0pt 0in 0in 0in'> <hr style='border:none;border-top:solid #E1E1E1 1.0pt'> From: Chad <innocentkiller@gmail.com> Sent: May 20, 2016 1:05:43 PM EDT To: "mediawiki-announce@lists.wikimedia.org" <mediawiki-announce@lists.wikimedia.org> Subject: [MediaWiki-announce] Security Release: 1.26.3, 1.25.6, and 1.23.14 </div> <pre class="k9mail">I would like to announce the release of MediaWiki 1.26.3, 1.25.6 and 1.23.14. These releases fix sixteen security issues in core, one issue in the bundled extension SyntaxHighlight_GeSHi and one issue in the non-bundled extension Scribunto. Download links are given at the end of this email. == Security fixes == * T122056: Old tokens are remaining valid within a new session * T127114: Login throttle can be tricked using non-canonicalized usernames * T123653: Cross-domain policy regexp is too narrow * T123071: Incorrectly identifying http link in a's href attributes, due to m modifier in regex * T129506: MediaWiki:Gadget-popups.js isn't renderable * T125283: Users occasionally logged in as different users after SessionManager deployment * T103239: Patrol allows click catching and patrolling of any page * T122807: [tracking] Check php crypto primatives * T98313: Graphs can leak tokens, leading to CSRF * T130947: Diff generation should use PoolCounter * T133507: Careless use of $wgExternalLinkTarget is insecure * T132874: API action=move is not rate limited This fix affects both core and SyntaxHighlight_GeSHi: * T110143: strip markers can be used to get around html attribute escaping in (many?) parser tags These two fixes are not applicable to 1.23.14 as the 1.23 branch does not contain pbkdf2 support. * T116030: Increase pbkdf2 parameter strengths * T127420: Pbkdf2Password does not check if hash_pbkdf2() succeeded This fix is already in master and the 1.27 release branch, and is just being backported to 1.23 and 1.25: * T126685: Globally throttle password attempts == Links to all mentioned tasks == <a href="https://phabricator.wikimedia.org/T122056">https://phabricator.wikimedia.org/T122056</a> <a href="https://phabricator.wikimedia.org/T127114">https://phabricator.wikimedia.org/T127114</a> <a href="https://phabricator.wikimedia.org/T123653">https://phabricator.wikimedia.org/T123653</a> <a href="https://phabricator.wikimedia.org/T123071">https://phabricator.wikimedia.org/T123071</a> <a href="https://phabricator.wikimedia.org/T129506">https://phabricator.wikimedia.org/T129506</a> <a href="https://phabricator.wikimedia.org/T125283">https://phabricator.wikimedia.org/T125283</a> <a href="https://phabricator.wikimedia.org/T103239">https://phabricator.wikimedia.org/T103239</a> <a href="https://phabricator.wikimedia.org/T122807">https://phabricator.wikimedia.org/T122807</a> <a href="https://phabricator.wikimedia.org/T98313">https://phabricator.wikimedia.org/T98313</a> <a href="https://phabricator.wikimedia.org/T130947">https://phabricator.wikimedia.org/T130947</a> <a href="https://phabricator.wikimedia.org/T133507">https://phabricator.wikimedia.org/T133507</a> <a href="https://phabricator.wikimedia.org/T132874">https://phabricator.wikimedia.org/T132874</a> <a href="https://phabricator.wikimedia.org/T110143">https://phabricator.wikimedia.org/T110143</a> <a href="https://phabricator.wikimedia.org/T116030">https://phabricator.wikimedia.org/T116030</a> <a href="https://phabricator.wikimedia.org/T127420">https://phabricator.wikimedia.org/T127420</a> <a href="https://phabricator.wikimedia.org/T126685">https://phabricator.wikimedia.org/T126685</a> == Release notes == Full release notes for 1.26.3: <<a href="https://www.mediawiki.org/wiki/Release_notes/1.26">https://www.mediawiki.org/wiki/Release_notes/1.26</a>> Full release notes for 1.25.6: <<a href="https://www.mediawiki.org/wiki/Release_notes/1.25">https://www.mediawiki.org/wiki/Release_notes/1.25</a>> Full release notes for 1.23.14: <<a href="https://www.mediawiki.org/wiki/Release_notes/1.23">https://www.mediawiki.org/wiki/Release_notes/1.23</a>> For information about how to upgrade, see <<a href="https://www.mediawiki.org/wiki/Manual:Upgrading">https://www.mediawiki.org/wiki/Manual:Upgrading</a>> ********************************************************************** 1.26.3 ********************************************************************** Download: <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.tar.gz">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.tar.gz</a> <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.3.tar.gz">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.3.tar.gz</a> Patch to previous version: <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.patch.gz">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.patch.gz</a> GPG signatures: <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.tar.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.patch.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.3.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.3.tar.gz.sig</a> Public keys: <a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a> ********************************************************************** 1.25.6 ********************************************************************** Download: <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.tar.gz">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.tar.gz</a> <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.6.tar.gz">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.6.tar.gz</a> Patch to previous version: <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.patch.gz">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.patch.gz</a> GPG signatures: <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.tar.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.patch.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.6.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.6.tar.gz.sig</a> Public keys: <a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a> ********************************************************************** 1.23.14 ********************************************************************** Download: <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.tar.gz">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.tar.gz</a> <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.14.tar.gz">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.14.tar.gz</a> Patch to previous version: <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.patch.gz">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.patch.gz</a> GPG signatures: <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.tar.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.patch.gz.sig</a> <a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.14.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.14.tar.gz.sig</a> Public keys: <a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a> -Chad H. & Chris S. <hr /> MediaWiki announcements mailing list To unsubscribe, go to: <a href="https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce">https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce</a> </pre> -- Sent from my Android device with K-9 Mail. Please excuse my brevity.</html>