Page MenuHomePhabricator
Create Task
Maniphest T311777

Obtain CVEs for 1.35.8/1.37.5/1.38.3 security releases
Closed, ResolvedPublic
Actions

Related Objects
Search...

Event Timeline

Reedy added projects: Security, MediaWiki-Releasing.Jun 30 2022, 9:02 PM
Reedy subscribed.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 30 2022, 9:02 PM
Reedy added a parent task: T311775: Release MediaWiki 1.35.8/1.37.5/1.38.3.Jun 30 2022, 9:02 PM
Reedy renamed this task from Obtain CVEs for 1.35.8/1.37.4/1.38.3 security releases to Obtain CVEs for 1.35.8/1.37.5/1.38.3 security releases.Jul 8 2022, 5:01 PM
Reedy added a comment.Sep 25 2022, 7:11 PM

T309894: CVE-2022-41765: HTMLUserTextField exposes existence of hidden users and T307278: CVE-2022-41766: On action=rollback the message "alreadyrolled" can leak revision deleted user name need a CVE.

Can't decide if we should get a CVE for T316304: CVE-2022-41767: reassignEdits doesn't update results in an IP range check on Special:Contributions..

Reedy changed the task status from Open to In Progress.Sep 28 2022, 7:05 PM
Reedy triaged this task as Medium priority.

Submitted!

Reedy closed this task as Resolved.Sep 29 2022, 9:15 PM
Reedy claimed this task.
Reedy changed the visibility from "acl*security (Project)" to "Public (No Login Required)".
Reedy changed the edit policy from "acl*security (Project)" to "All Users".
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits