Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Mageia: 2020-0292 Moderate: MediaWiki Information Disclosure

mageia
Calendar Grey July 10, 2020
Dist Mageia Esm H88
Mageia discovers and resolves a significant security vulnerability in MediaWiki that impacts private wikis secured by caching servers.
Updated mediawiki packages fix security vulnerability: In MediaWiki before 1.31.8, private wikis behind a caching server using the img_auth.php image authorization security featur...

Summary

Updated mediawiki packages fix security vulnerability:
In MediaWiki before 1.31.8, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled (CVE-2020-15005).

References

- https://bugs.mageia.org/show_bug.cgi?id=26921

- https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/X4YHE5EVSEZFBQS2NRUDPN5VIL3EFKLR/

- https://www.cve.org/CVERecord?id=CVE-2019-XXXX

Topics%20covered

Topics Covered

security advisory information disclosure mediawiki Mageia cache mishandling

Resolution

SRPMS

- 7/core/mediawiki-1.31.8-1.mga7

Publication date: 10 Jul 2020
URL: https://advisories.mageia.org/MGASA-2020-0292.html
Type: security
CVE: CVE-2019-XXXX

Topics%20covered

Topics Covered

security advisory information disclosure mediawiki Mageia cache mishandling

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here