Page MenuHomePhabricator
Create Task
Maniphest T397767

Tracking bug for MediaWiki 1.39.14/1.43.4/1.44.1
Closed, ResolvedPublic
Actions

Description

Previous work: {T389303}

Tracking bug for the next security release, 1.39.14/1.43.4/1.44.1

Related Objects
Search...

StatusSubtypeAssignedTask
Restricted Task
 ResolvedNoneT397767 Tracking bug for MediaWiki 1.39.14/1.43.4/1.44.1
Restricted Task
Restricted Task
 OpenBPirkleT389587 [SPIKE] Optimize PageHTMLHandler::getETag to avoid ParserOutput
 ResolveddanielT390200 REST: compute etags only when needed.
 ResolvedBPirkleT389588 /w/rest.php/v1/page/:title/ should not follow indirect redirects
Restricted Task
 OpenNoneT391477 Create a short term parser cache for use with poolcounter
 DeclineddanielT391655 Proposal: allow clients to control caching behavior of HTML endpoints using a cache-control header
 ResolvedBUG REPORTReedyT396951 FreeOTP refuses to add MediaWiki's 2FA details, because "token is unsafe"
 ResolvedSecuritySomeRandomDeveloperT394856 CVE-2025-61637: Stored XSS through system messages in MW Core
 ResolvedSecuritySomeRandomDeveloperT398636 CVE-2025-61657: Stored XSS through system messages in sticky header buttons in Vector
Restricted Task
 ResolvedSecuritydmazaT394396 CVE-2025-61636: Codex Special:Block vulnerable to message key XSS
Restricted Task
 ResolvedNoneT396248 Update the DiscussionTools post-cache HTML pass to use Remex instead of regexes
 ResolvedSecuritySomeRandomDeveloperT395858 CVE-2025-61655: Stored XSS through system messages in VisualEditor
Restricted Task
Restricted Task
 ResolvedSecurityLucas_Werkmeister_WMDET401099 CVE-2025-61638: Sanitizer::validateAttributes data-XSS
 ResolvedSecurity• JlyT402075 CVE-2025-61640: Stored XSS through system messages in Special:RecentChangesLinked (MW Core)
 ResolvedSecurityMstylesT401862 CVE-2025-11173: Reauth for enabling 2FA can be bypassed by submitting a form
Restricted Task
 ResolvedSecurityCatropeT402313 CVE-2025-61642: Stored XSS through system messages provided to CodexHtmlForms
Restricted Task
Restricted Task
Restricted Task
 ResolvedSecuritymszwarcT404805 CVE-2025-61658: Special:GlobalContributions shows edits on wikis the viewer doesn't have access to
Restricted Task
 ResolvedSecurityfnegriT402283 Title of suppressed recentchanges entries can be viewed through the wiki replicas
Restricted Task
 ResolvedSecuritySomeRandomDeveloperT402077 CVE-2025-61648: Stored XSS through system messages in CheckUser

Event Timeline

Reedy added projects: Security, MediaWiki-Releasing.Jun 24 2025, 8:05 PM
Reedy subscribed.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 24 2025, 8:05 PM
Reedy added a parent task: Restricted Task.Jun 24 2025, 8:06 PM
Reedy updated the task description. (Show Details)Jun 24 2025, 8:06 PM
Reedy added a subtask: Restricted Task.
Reedy added a subtask: Restricted Task.Jun 24 2025, 8:24 PM
Reedy added a subtask: Restricted Task.
Reedy added a subtask: T396951: FreeOTP refuses to add MediaWiki's 2FA details, because "token is unsafe".Jun 24 2025, 8:35 PM
Reedy closed subtask T396951: FreeOTP refuses to add MediaWiki's 2FA details, because "token is unsafe" as Resolved.Jun 24 2025, 8:39 PM
sbassett changed the status of subtask Restricted Task from Open to In Progress.Jun 27 2025, 10:02 PM
Reedy renamed this task from Tracking bug for MediaWiki 1.39.14/1.43.3/1.44.1 to Tracking bug for MediaWiki 1.39.14/1.43.4/1.44.1.Jul 1 2025, 3:41 PM
Reedy updated the task description. (Show Details)
sbassett added a subtask: T394856: CVE-2025-61637: Stored XSS through system messages in MW Core.Jul 1 2025, 4:13 PM
sbassett added a subtask: T398636: CVE-2025-61657: Stored XSS through system messages in sticky header buttons in Vector.Jul 7 2025, 9:44 PM
sbassett added a subtask: Restricted Task.
sbassett added a subtask: T394396: CVE-2025-61636: Codex Special:Block vulnerable to message key XSS.Jul 8 2025, 8:30 PM
Mstyles added a subtask: Restricted Task.Jul 21 2025, 8:25 PM
sbassett added a subtask: Restricted Task.Jul 25 2025, 10:48 PM
sbassett added a subtask: T395858: CVE-2025-61655: Stored XSS through system messages in VisualEditor.Jul 28 2025, 10:38 PM
sbassett added a subtask: Restricted Task.Aug 11 2025, 9:21 PM
sbassett added a subtask: Restricted Task.Aug 12 2025, 6:58 PM
sbassett added a subtask: T401099: CVE-2025-61638: Sanitizer::validateAttributes data-XSS.Aug 14 2025, 3:14 PM
sbassett added a subtask: T400892: CVE-2025-62669: UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks.Aug 18 2025, 3:59 PM
Mstyles added a subtask: T402075: CVE-2025-61640: Stored XSS through system messages in Special:RecentChangesLinked (MW Core).Aug 19 2025, 12:23 AM
sbassett removed a subtask: T400892: CVE-2025-62669: UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks.Aug 19 2025, 9:13 PM
• mszabo changed the status of subtask Restricted Task from Open to In Progress.Aug 20 2025, 10:59 AM
• mszabo closed subtask Restricted Task as Resolved.Aug 20 2025, 2:05 PM
sbassett added a subtask: T401862: CVE-2025-11173: Reauth for enabling 2FA can be bypassed by submitting a form.Aug 25 2025, 4:21 PM
sbassett added a subtask: T402077: CVE-2025-61648: Stored XSS through system messages in CheckUser.Aug 25 2025, 9:29 PM
Mstyles added a subtask: Restricted Task.Aug 25 2025, 11:07 PM
Mstyles added a subtask: Restricted Task.Aug 25 2025, 11:10 PM
Mstyles added a subtask: T402313: CVE-2025-61642: Stored XSS through system messages provided to CodexHtmlForms.Aug 28 2025, 9:56 PM
sbassett added a subtask: T403289: CVE-2025-61650: UserInfoCard is vulnerable to message key stored XSS.Sep 2 2025, 9:54 PM
sbassett added a subtask: T403411: CVE-2025-61644: i18n XSS through Special:Watchlist.Sep 4 2025, 9:29 PM
sbassett added a subtask: Restricted Task.Sep 4 2025, 9:33 PM
Mstyles added a subtask: Restricted Task.Sep 8 2025, 10:09 PM
Dreamy_Jazz closed subtask Restricted Task as Resolved.Sep 16 2025, 7:41 AM
Mstyles added a subtask: Restricted Task.Sep 22 2025, 9:46 PM
Mstyles added a subtask: Restricted Task.
sbassett added a subtask: T404805: CVE-2025-61658: Special:GlobalContributions shows edits on wikis the viewer doesn't have access to.Sep 24 2025, 1:19 PM
Reedy removed a subtask: Restricted Task.Sep 29 2025, 1:05 PM
Reedy added a subtask: Restricted Task.Sep 29 2025, 6:08 PM
Reedy closed subtask Restricted Task as Resolved.Sep 29 2025, 10:42 PM
Reedy closed subtask T401099: CVE-2025-61638: Sanitizer::validateAttributes data-XSS as Resolved.
Reedy closed subtask Restricted Task as Resolved.Sep 29 2025, 11:43 PM
Reedy removed a subtask: Restricted Task.Sep 29 2025, 11:51 PM
Reedy removed a subtask: T403289: CVE-2025-61650: UserInfoCard is vulnerable to message key stored XSS.
Reedy removed a subtask: Restricted Task.Sep 29 2025, 11:53 PM
Reedy removed a subtask: T402077: CVE-2025-61648: Stored XSS through system messages in CheckUser.Sep 29 2025, 11:57 PM
Reedy removed a subtask: T403411: CVE-2025-61644: i18n XSS through Special:Watchlist.Sep 30 2025, 12:31 AM
Dreamy_Jazz added a subtask: T402077: CVE-2025-61648: Stored XSS through system messages in CheckUser.Sep 30 2025, 9:39 AM
Reedy closed subtask T394856: CVE-2025-61637: Stored XSS through system messages in MW Core as Resolved.Oct 1 2025, 8:50 PM
Reedy closed subtask Restricted Task as Resolved.Oct 1 2025, 8:52 PM
Reedy closed subtask T394396: CVE-2025-61636: Codex Special:Block vulnerable to message key XSS as Resolved.
Reedy closed subtask T398636: CVE-2025-61657: Stored XSS through system messages in sticky header buttons in Vector as Resolved.
Reedy closed subtask T395858: CVE-2025-61655: Stored XSS through system messages in VisualEditor as Resolved.
Reedy closed subtask Restricted Task as Resolved.
Reedy closed subtask Restricted Task as Resolved.
Reedy closed subtask T402075: CVE-2025-61640: Stored XSS through system messages in Special:RecentChangesLinked (MW Core) as Resolved.Oct 1 2025, 8:55 PM
Reedy closed subtask Restricted Task as Resolved.
Reedy closed subtask T402313: CVE-2025-61642: Stored XSS through system messages provided to CodexHtmlForms as Resolved.
Reedy closed subtask Restricted Task as Resolved.
Reedy closed subtask Restricted Task as Resolved.
Reedy closed subtask T404805: CVE-2025-61658: Special:GlobalContributions shows edits on wikis the viewer doesn't have access to as Resolved.
Reedy closed subtask T402077: CVE-2025-61648: Stored XSS through system messages in CheckUser as Resolved.
sbassett closed subtask T394396: CVE-2025-61636: Codex Special:Block vulnerable to message key XSS as Resolved.Oct 6 2025, 4:23 PM
Reedy closed subtask Restricted Task as Resolved.Dec 16 2025, 5:54 PM
Aklapper added a comment.Jan 16 2026, 11:20 AM

These tarballs have long been released. Can this be resolved?
Current tracking ticket seems to be T411385 instead.

Catrope closed this task as Resolved.Jan 26 2026, 7:03 PM
• Zabe changed the visibility from "acl*security (Project)" to "Public (No Login Required)".Jan 26 2026, 7:12 PM
• Zabe changed the edit policy from "acl*security (Project)" to "All Users".
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits