Stay Secure with the Latest Linux Advisories

security advisorymoderateinformation disclosure

Mageia 6: MGASA-2018-0433 Moderate: Mediawiki Account Bypass

Updated mediawiki packages fix security vulnerabilities: '$wgRateLimits' entry for 'user' overrides 'newbie' (CVE-2018-0503). When a log event is (partially) hidden Special:Redirect/logid can link . MGASA-2018-0433 - Updated mediawiki packages fix security vulnerabilities Publication date: 03 Nov 2018 URL: https://advisories.mageia.org/MGASA-2018-0433.html Type: security Affected Mageia releases: 6 CVE: CVE-2018-0503, CVE-2018-0504, CVE-2018-0505 Updated mediawiki packages fix security vulnerabilities: '$wgRateLimits' entry for 'user' overrides 'newbie' (CVE-2018-0503). When a log event is (partially) hidden Special:Redirect/logid can link to the incorrect log and reveal hidden information (CVE-2018-0504). BotPasswords can bypass CentralAuth's account lock (CVE-2018-0505). References: - https://bugs.mageia.org/show_bug.cgi?id=23662 - https://lists.wikimedia.org/hyperkitty/list/This email address is being protected from spambots. You need JavaScript enabled to view it./message/LEXZ2QALRATNRZBLFXYWCIJH4G5S2L3T/ - https://www.cve.org/CVERecord?id=CVE-2018-0503 - https://www.cve.org/CVERecord?id=CVE-2018-0504 - https://www.cve.org/CVERecord?id=CVE-2018-0505 SRPMS: - 6/core/mediawiki-1.27.5-1.mga6 . Updated Mediawiki packages address various security vulnerabilities in Mageia, impacting account and logging data.. mediawiki security,Mageia advisory,information disclosure,account bypass. . LinuxSecurity.com Team

Nov 03, 2018 Mageia