| Legoktm | |
| Mar 8 2021, 5:22 PM |
| F34180145: 0001-SECURITY-Disable-various-lexers-because-of-DoS-attac.patch | |
| Mar 23 2021, 1:56 AM |
| F34150046: 0001-SECURITY-Disable-sml-because-of-infinite-loop-DoS-CV.patch | |
| Mar 10 2021, 6:27 PM |
See https://github.com/pygments/pygments/issues/1625 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20270
Probably we should just update both to 2.7.4. We just updated master to 2.8.0, so it's not vulnerable.
References for CVE-2021-27291:
https://gist.github.com/b-c-ds/b1a2cc0c68a35c57188575eb496de5ce
https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Reedy | T270458 Release MediaWiki 1.31.13/1.35.2 | |||
| Resolved | Reedy | T270459 Tracking bug for MediaWiki 1.31.13/1.35.2 | |||
| Resolved | Security | Legoktm | T276843 Bundled pygments in REL1_31 / REL1_35 vulnerable to CVE-2021-20270 and CVE-2021-27291 |
Given that REL1_31 is on such an old version I think we could just disable sml rather than risk a bunch of potentially breaking changes.
It it's OK with the security team I think we should do the REL1_35 version bump in Gerrit since binary patch files are pretty annoying.
Probably the lowest risk option if it won't degrade any functionality.
It it's OK with the security team I think we should do the REL1_35 version bump in Gerrit since binary patch files are pretty annoying.
I'd rate this low risk if we can get it merged prior to the upcoming security release, unless @Reedy has other concerns.
Indeed. The upstream task is public, it has a CVE attached, so it's obvious there's a security component to the bug, and basically a simple replication criteria in the task too.
Therefore pushing fixes in public (to the extension/branches) for dealing with it does highlight the issue a bit, but I don't think it's a major concern. Fix should be released more formally in the next couple of weeks anyway for T270458: Release MediaWiki 1.31.13/1.35.2
So for REL1_35, 2.7.4 is the minimum safe version to address the sml CVE? Just wondering if there was any other reason not to bump to 2.8.0 like master.
Yes. Mostly just to minimize the amount of changes in a stable branch. Based on https://pygments.org/docs/changelog/#version-2-8-0 it looks like upstream did a lot of internal refactoring in this release, and we really haven't run it in production for that long yet. They also just released 2.8.1 a few days ago so... I think 2.7.4 is just the more conservative option.
There's a second CVE ID for pygments: CVE-2021-27291
https://gist.github.com/b-c-ds/b1a2cc0c68a35c57188575eb496de5ce and fixed via https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14
Fortunately it's also fixed via 2.7.4.
Yes. https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SyntaxHighlight_GeSHi/+/670552 is the fix for REL1_35
Change 678024 had a related patch set uploaded (by Reedy; author: Legoktm):
[mediawiki/extensions/SyntaxHighlight_GeSHi@REL1_31] SECURITY: Disable various lexers because of DoS attacks
Change 678024 merged by jenkins-bot:
[mediawiki/extensions/SyntaxHighlight_GeSHi@REL1_31] SECURITY: Disable various lexers because of DoS attacks