—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3821
mediawiki security update
6 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: mediawiki
Publisher: Debian
Operating System: Debian GNU/Linux
Resolution: Patch/Upgrade
CVE Names: CVE-2023-36675 CVE-2023-36674 CVE-2023-29141
Original Bulletin:
https://lists.debian.org/debian-security-announce/2023/msg00139.html
Comment: CVSS (Max): 9.8* CVE-2023-29141 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: NVD
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* Not all CVSS available when published
– ————————–BEGIN INCLUDED TEXT——————–
– —–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512
– – ————————————————————————-
Debian Security Advisory DSA-5447-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
July 05, 2023 https://www.debian.org/security/faq
– – ————————————————————————-
Package : mediawiki
CVE ID : CVE-2023-29141 CVE-2023-36674 CVE-2023-36675
Debian Bug : 1039075
Multiple security issues were discovered in MediaWiki, a website engine
for collaborative work, which could result in cross-site scripting, a
bypass of vandalism protections or information disclosure.
For the oldstable distribution (bullseye), these problems have been fixed
in version 1:1.35.11-1~deb11u1.
For the stable distribution (bookworm), these problems have been fixed in
version 1:1.39.4-1~deb12u1.
We recommend that you upgrade your mediawiki packages.
For the detailed security status of mediawiki please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/mediawiki
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: [email protected]
– —–BEGIN PGP SIGNATURE—–
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmSlqxIACgkQEMKTtsN8
TjbJRBAAodt+4EzI/HLq3hr2OU6K3WE6W2ThrPSMNev0TLyCTw7GeX4avi3cKjNL
wqdPWGE4BjC6YAb5qU6Z9rqL00megvqihL5kaf010++jXk1/9uruENkOSj+KJuWt
qLIvX3MYH4EU5gLRD6we8+LzTJQX46UNXtUVSQ7ixZNegzWGbZ8usI046x3YwAHV
MTf5tn3M/XBKdhd9UcvffB+qM4Dkyyr1+/tJXyIzxYq8RbHDFW8ggvKZTJ1xSXVY
4G0G4k+kQEvWtyUvIzypj5hdAI2zzSUXstFKl64dMwS35hXq8HrORJZwYVTgmLw5
6D346wYr5SelP++NO5Ap+nGmjc4bn3UxAMnc6EvCKC5L9nO8dYviMMe7EyLqyKhd
rPXJXV0c+Yxznn3SRh9iRoVXwkfEmE+JT562qvk3ozu548AH8NzRaCEdv7Dzuxhg
BSrZMbOozDTmMiEUbe7beKfhSwo8tpRqlVlcA4Pk+v2TnEE6sQN6+gwrLaOyv7N9
zwlofFHrjMyR68oFyNg9+cWhuLpca+NUjJE1mzk7V+2ehh1bH83YNAeStYqYqgK1
oJcKNS/xVhCOm246TOwCROw5FwO7oZTYy44BUXrMZh+t/Srf2ko7lsYlPLWoz8t0
gfZ47YMraeNoiewkq7Ij8RvhL/ZKOlB45MHlWewh0KR97HwItOE=
=1rTe
– —–END PGP SIGNATURE—–
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZKYvCckNZI30y1K9AQhtGw//Uj+Ql9LT/Znwts6RzBYNPyVpd0xJ5dRW
UHRxsdviA6ijfGEClIgLKHXCX5fHJpxs5APG5xfthBSqVjVx1aOkTsl7txbHCRg2
fftsALGutxtFfHTlxt7pKVOa/UTDy2tyBuWx2xk1ye4/xUXsEMa7g+qRqdDcG/1i
zOjKO9h0/k8Ypgaf0N8HK6+GFlLow49gTFF+uhY/OI9csGyuirMuT16Pbj+77Pq8
y/AeV63vDDhx+AsXlPv9QZaqrx5yvtEA4K6zinaiLGNj8KbyUXpYwTNnx0Ut+f7a
xa3JHk9URi822wnhRKDXjR/RapitFYv8Pf3e4cEaGTUaESMipLWzkdypjgL/m3uD
Ffi4eZdJUqURr0RqTSShreXTQ4EIA6N8wrPGHvuuVtZ8HAXyo9HXTXxdPMRIScFn
25MKhk1sJlWT+sMp0+cS4806Cd47odTleubMygW7PfxDYHSky4CuZ22EP0yj2If/
MXBqbaXDqcykpgj0X4R00qZZ2vTuf4FlVWIdhoRcVUl6RwABqM3iLsDn4jidO66v
ZCEAAhkEDR9R+p9gnlIox9/I2EwU/ftwf34puMyp3TDEe4EoAsA32YWOXW3kghXO
6ye14C1jtsOzZcDjImBpQ53QSC1ZVXByT81gNhObv6CfrVDIXCB/UOWsP7p6A4Ol
vHgkCExKvmI=
=ODXy
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins