<html> <head> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> </head> <body> <div class="moz-forward-container"> -------- Forwarded Message -------- <table class="moz-email-headers-table" cellspacing="0" cellpadding="0" border="0"> <tbody> <tr> <th valign="BASELINE" nowrap="nowrap" align="RIGHT">Subject: </th> <td>[MediaWiki-announce] Security and maintenance release: 1.31.9 / 1.34.3</td> </tr> <tr> <th valign="BASELINE" nowrap="nowrap" align="RIGHT">Date: </th> <td>Thu, 24 Sep 2020 16:05:38 +0100</td> </tr> <tr> <th valign="BASELINE" nowrap="nowrap" align="RIGHT">From: </th> <td>Sam Reed <a class="moz-txt-link-rfc2396E" href="mailto:reedy@wikimedia.org"><reedy@wikimedia.org></a></td> </tr> <tr> <th valign="BASELINE" nowrap="nowrap" align="RIGHT">Reply-To: </th> <td><a class="moz-txt-link-abbreviated" href="mailto:wikitech-l@lists.wikimedia.org">wikitech-l@lists.wikimedia.org</a></td> </tr> <tr> <th valign="BASELINE" nowrap="nowrap" align="RIGHT">To: </th> <td>MediaWiki announcements and site admin list <a class="moz-txt-link-rfc2396E" href="mailto:mediawiki-l@lists.wikimedia.org"><mediawiki-l@lists.wikimedia.org></a>, <a class="moz-txt-link-abbreviated" href="mailto:mediawiki-announce@lists.wikimedia.org">mediawiki-announce@lists.wikimedia.org</a>, <a class="moz-txt-link-abbreviated" href="mailto:wikitech-l@lists.wikimedia.org">wikitech-l@lists.wikimedia.org</a></td> </tr> </tbody> </table> I would like to announce the release of MediaWiki 1.34.3, and 1.31.9! These releases also serve as a maintenance release for these branches. While tarballs have already been uploaded, git tags will follow later on today. An "MediaWiki Extensions Security Release Supplement" email will follow this one. As mentioned in the pre-release announcement, this will potentially be the final release of the MediaWiki 1.34 branch, barring any unforeseen issues. For continued support in the future, you are advised to upgrade to MediaWiki 1.35 in the near future. The release announcement for MediaWiki 1.35 will follow this one before the end of day tomorrow. MediaWiki 1.35 will be supported until September 2023. == Security fixes == * (T232568, CVE-2020-25813) SECURITY: SpecialUserrights: If a viewer lacks `hideuser`, ignore hidden users. * (T255918, CVE-2020-25812) SECURITY: Unescaped message used in HTML on Special:Contributions. * (T256171, CVE-2020-25815) SECURITY: Unescaped message used in HTML within LogEventsList. * (T258763, CVE-2020-17367, CVE-2020-17368) SECURITY: Prevent invoking firejail's --output functionality. * (T86738, CVE-2020-25814) SECURITY: mediawiki.jqueryMsg: Sanitize URLs and 'style' attribute. * (T115888, CVE-2020-25828) SECURITY: mediawiki.js: Escape HTML in mw.message( ... ).parse(). * (T260485, CVE-2020-25869) SECURITY: ActorMigration: Load user from the correct database. * (T260485, CVE-2020-25869) SECURITY: ensure actor ID from correct wiki is used. * (T251661, CVE-2020-25827) SECURITY: TOTP throttle not enforced cross-wiki. == Links to all mentioned tasks == * <a class="moz-txt-link-freetext" href="https://phabricator.wikimedia.org/T232568">https://phabricator.wikimedia.org/T232568</a> * <a class="moz-txt-link-freetext" href="https://phabricator.wikimedia.org/T255918">https://phabricator.wikimedia.org/T255918</a> * <a class="moz-txt-link-freetext" href="https://phabricator.wikimedia.org/T256171">https://phabricator.wikimedia.org/T256171</a> * <a class="moz-txt-link-freetext" href="https://phabricator.wikimedia.org/T258763">https://phabricator.wikimedia.org/T258763</a> * <a class="moz-txt-link-freetext" href="https://phabricator.wikimedia.org/T86738">https://phabricator.wikimedia.org/T86738</a> * <a class="moz-txt-link-freetext" href="https://phabricator.wikimedia.org/T115888">https://phabricator.wikimedia.org/T115888</a> * <a class="moz-txt-link-freetext" href="https://phabricator.wikimedia.org/T260485">https://phabricator.wikimedia.org/T260485</a> * <a class="moz-txt-link-freetext" href="https://phabricator.wikimedia.org/T251661">https://phabricator.wikimedia.org/T251661</a> == Release notes == Full release notes for 1.31.9: <a class="moz-txt-link-freetext" href="https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_31/RELEASE-NOTES-1.31">https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_31/RELEASE-NOTES-1.31</a> <a class="moz-txt-link-freetext" href="https://www.mediawiki.org/wiki/Release_notes/1.31">https://www.mediawiki.org/wiki/Release_notes/1.31</a> Full release notes for 1.34.3: <a class="moz-txt-link-freetext" href="https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_34/RELEASE-NOTES-1.34">https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_34/RELEASE-NOTES-1.34</a> <a class="moz-txt-link-freetext" href="https://www.mediawiki.org/wiki/Release_notes/1.34">https://www.mediawiki.org/wiki/Release_notes/1.34</a> For information about how to upgrade, see <a class="moz-txt-link-rfc2396E" href="https://www.mediawiki.org/wiki/Manual:Upgrading"><https://www.mediawiki.org/wiki/Manual:Upgrading></a> ********************************************************************** Download: <a class="moz-txt-link-freetext" href="https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.tar.gz">https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.tar.gz</a> Download without bundled extensions: <a class="moz-txt-link-freetext" href="https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.9.tar.gz">https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.9.tar.gz</a> Patch to previous version (1.31.8): <a class="moz-txt-link-freetext" href="https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.patch.gz">https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.patch.gz</a> GPG signatures: <a class="moz-txt-link-freetext" href="https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.9.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.9.tar.gz.sig</a> <a class="moz-txt-link-freetext" href="https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.tar.gz.sig</a> <a class="moz-txt-link-freetext" href="https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.patch.gz.sig</a> Public keys: <a class="moz-txt-link-freetext" href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a> ********************************************************************** Download: <a class="moz-txt-link-freetext" href="https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.3.tar.gz">https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.3.tar.gz</a> Download without bundled extensions: <a class="moz-txt-link-freetext" href="https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.3.tar.gz">https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.3.tar.gz</a> Patch to previous version (1.34.2): <a class="moz-txt-link-freetext" href="https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.3.patch.gz">https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.3.patch.gz</a> GPG signatures: <a class="moz-txt-link-freetext" href="https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.3.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.3.tar.gz.sig</a> <a class="moz-txt-link-freetext" href="https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.3.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.3.tar.gz.sig</a> <a class="moz-txt-link-freetext" href="https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.3.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.3.patch.gz.sig</a> Public keys: <a class="moz-txt-link-freetext" href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a> _______________________________________________ MediaWiki announcements mailing list To unsubscribe, go to: <a class="moz-txt-link-freetext" href="https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce">https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce</a> </div> </body> </html>