Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Debian 10 Mediawiki Security Advisory DLA-3671-1 Critical Threats

debian lts
Calendar Grey November 28, 2023
Dist Debian Esm H88
Several security flaws in MediaWiki have been addressed in Debian LTS DLA-3671-1. It is recommended that users update to reduce potential threats.
Multiple vulnerabilities were found in mediawiki, a website engine for collaborative work, that could lead to information disclosure, privilege escalation, or denial of service
Topics%20covered

Topics Covered

security advisory denial of service information leak privilege escalation Debian mediawiki

Summary

CVE-2023-3550

Carlos Bello reported a stored cross-site scripting (XSS)
vulnerability when uploading crafted XML file to Special:Upload,
which can lead to privilege escalation. (However .xml file uploads
are not allowed in the default configuration.)

CVE-2023-45362

Tobias Frei discovered that diff-multi-sameuser (“X intermediate
revisions by the same user not shown”) ignores username suppression,
which can lead to information leak.

CVE-2023-45363

It was discovered that querying pages redirected to other variants
with `redirects` and `converttitles` parameters set would cause
a denial of service (unbounded loop and RequestTimeoutException).

For Debian 10 buster, these problems have been fixed in version
1:1.31.16-1+deb10u7.

We recommend that you upgrade your mediawiki packages.

For the detailed security status of mediawiki please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/mediawiki

Read the Full Advisory


Severity
critical
Lowest
Low
Medium
High
Critical

Package: mediawiki
Version: 1:1.31.16-1+deb10u7
CVE ID: CVE-2023-3550 CVE-2023-45362 CVE-2023-45363

Topics%20covered

Topics Covered

security advisory denial of service information leak privilege escalation Debian mediawiki

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here