1.39.3
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Reedy
	Dec 22 2022, 10:13 PM

Description

Previous work: {T318965}

Tracking bug for next security release, 1.35.10/1.38.6/1.39.3

Note: Added T326946: CVE-2020-36649: Bundled PapaParse copy in VisualEditor has known ReDos for a possible mention within the next release, even though it's already public and very wikimedia-specific.

Details

Subject	Repo	Branch	Lines +/-
RELEASE-NOTES-1.39: Add CVE number	mediawiki/core	REL1_39	+1 -1
RELEASE-NOTES-1.35: Add CVE number	mediawiki/core	REL1_35	+1 -1
RELEASE-NOTES-1.38: Add CVE number	mediawiki/core	REL1_38	+1 -1

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
Resolved		Reedy	T325839 Release MediaWiki 1.35.10/1.38.6/1.39.3
Resolved		Reedy	T325840 Tracking bug for MediaWiki 1.35.10/1.38.6/1.39.3
Resolved	Security	None	T285159 CVE-2023-29141: X-Forwarded-For header allows brute-forcing autoblocked IP addresses
Resolved	Security	Esanders	T326946 CVE-2020-36649: Bundled PapaParse copy in VisualEditor has known ReDos
Resolved	Security	Reedy	T330086 CVE-2023-29142: OATHAuth allows replay attacks when MediaWiki is configured without ObjectCache; Insecure Default Configuration

Event Timeline

Reedy added projects: Security, MediaWiki-Releasing.Dec 22 2022, 10:13 PM

Reedy subscribed.

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 22 2022, 10:13 PM

Reedy added a parent task: T325839: Release MediaWiki 1.35.10/1.38.6/1.39.3.Dec 22 2022, 10:14 PM

DannyS712 updated the task description. (Show Details)Dec 23 2022, 1:32 AM

sbassett added a subtask: T285159: CVE-2023-29141: X-Forwarded-For header allows brute-forcing autoblocked IP addresses.Jan 23 2023, 10:22 PM

sbassett triaged this task as Low priority.Feb 13 2023, 4:24 PM

sbassett added a subtask: T326946: CVE-2020-36649: Bundled PapaParse copy in VisualEditor has known ReDos.

sbassett updated the task description. (Show Details)

sbassett updated the task description. (Show Details)Feb 15 2023, 4:32 PM

Reedy mentioned this in T330086: CVE-2023-29142: OATHAuth allows replay attacks when MediaWiki is configured without ObjectCache; Insecure Default Configuration.Feb 20 2023, 3:08 PM

Reedy renamed this task from Tracking bug for MediaWiki 1.35.10/1.38.6/1.39.2 to Tracking bug for MediaWiki 1.35.10/1.38.6/1.39.3.Feb 21 2023, 4:06 PM

Reedy updated the task description. (Show Details)

Reedy added a subtask: T330086: CVE-2023-29142: OATHAuth allows replay attacks when MediaWiki is configured without ObjectCache; Insecure Default Configuration.Mar 20 2023, 4:20 PM

Reedy closed subtask T330086: CVE-2023-29142: OATHAuth allows replay attacks when MediaWiki is configured without ObjectCache; Insecure Default Configuration as Resolved.Mar 30 2023, 10:12 PM

Reedy closed subtask T285159: CVE-2023-29141: X-Forwarded-For header allows brute-forcing autoblocked IP addresses as Resolved.Mar 30 2023, 10:34 PM

DannyS712 mentioned this in T333617: Tracking bug for MediaWiki 1.35.11/1.38.7/1.39.4/1.40.0.Apr 4 2023, 3:34 PM

Reedy closed this task as Resolved.Apr 4 2023, 4:52 PM

Reedy claimed this task.

Reedy changed the visibility from "acl*security (Project)" to "Public (No Login Required)".Apr 4 2023, 4:59 PM

Reedy changed the edit policy from "acl*security (Project)" to "All Users".

Change 905671 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/core@REL1_35] RELEASE-NOTES-1.35: Add CVEs

https://gerrit.wikimedia.org/r/905671