[IT-SecNots] [MediaWiki-announce] MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12

[Markus Glaser <glaser AT hallowelt.biz>]

Hello everyone,

I would like to announce the release of MediaWiki 1.22.3, 1.21.6 and 1.19.12.
These releases fix a number of security related bugs that could affect users 
of MediaWiki. In addition, MediaWiki 1.22.3 is a maintenance release. It 
fixes 
several bugs. You can consult the RELEASE-NOTES-1.22 file for the full list 
of 
changes in this version. Download links are given at the end of this email.

== Security fixes ==
* (bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted
  namespaces. Also disallow iframe elements. User will get an error
  including the namespace name if they use a non- whitelisted namespace.
* (bug 61346) SECURITY: Make token comparison use constant time. It seems like
  our token comparison would be vulnerable to timing attacks. This will take
  constant time.
* (bug 61362) SECURITY: API: Don't find links in the middle of api.php links.

== Bug fixes in 1.22.3 ==

* (bug 53710) Add sequence support for upsert in DatabaseOracle in the same 
way
  as in selectInsert
* (bug 60231, 58719) Various fixes to job running code in Wiki.php: Make it
  async on Windows. Fixed possible "invalid filename" errors on Windows.
  Redirect output to dev/null to avoid hanging PHP.
* (bug 60083) Correct sequence name for fresh Postgres installation. Spotted
  by gebhkla
* (bug 60531) Avoid variable naming conflicts in
  DatabasePostgres::selectSQLText. Spotted by gebhkla
* (bug 60094) Fix rebuildall.php fatal error with PostgreSQL. The fix for
  47055 introduced a fatal error when running rebuildall.php. This is a
  workaround suggested by gebhkla on Bugzilla. It just checks to make sure
  $options is actually an array before calling array_search on it.
* (bug 43817c12) Add error handling if descriptionmsg isn't defined for
  extension.
* (bug 60543) Special:PrefixIndex omits stripprefix=1 for "Next page" link.

Full release notes for 1.22.3:
<https://www.mediawiki.org/wiki/Release_notes/1.22>

Full release notes for 1.21.6:
<https://www.mediawiki.org/wiki/Release_notes/1.21>

Full release notes for 1.19.12:
<https://www.mediawiki.org/wiki/Release_notes/1.19>

For information about how to upgrade, see 
<https://www.mediawiki.org/wiki/Manual:Upgrading>

**********************************************************************
   1.22.3
**********************************************************************
Download:
http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.3.tar.gz

Patch to previous version (1.22.2), without interface text:
http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.3.patch.gz
Interface text changes:
http://releases.wikimedia.org/mediawiki/1.22/mediawiki-i18n-1.22.3.patch.gz

GPG signatures:
http://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.3.tar.gz.sig
http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.3.tar.gz.sig
http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.3.patch.gz.sig
http://releases.wikimedia.org/mediawiki/1.22/mediawiki-i18n-1.22.3.patch.gz.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

**********************************************************************
   1.21.6
**********************************************************************
Download:
http://releases.wikimedia.org/mediawiki/1.21/mediawiki-1.21.6.tar.gz

Patch to previous version (1.21.3), without interface text:
http://releases.wikimedia.org/mediawiki/1.21/mediawiki-1.21.6.patch.gz
Interface text changes:
http://releases.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.6.patch.gz

GPG signatures:
http://releases.wikimedia.org/mediawiki/1.21/mediawiki-core-1.21.6.tar.gz.sig
http://releases.wikimedia.org/mediawiki/1.21/mediawiki-1.21.6.tar.gz.sig
http://releases.wikimedia.org/mediawiki/1.21/mediawiki-1.21.6.patch.gz.sig
http://releases.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.6.patch.gz.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

**********************************************************************
   1.19.12
**********************************************************************
Download:
http://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.12.tar.gz

Patch to previous version (1.19.11), without interface text:
http://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.12.patch.gz
Interface text changes:
http://releases.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.12.patch.gz

GPG signatures:
http://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.12.tar.gz.sig
http://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.12.tar.gz.sig
http://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.12.patch.gz.sig
http://releases.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.12.patch.gz.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

--mglaser
_______________________________________________
MediaWiki announcements mailing list
To unsubscribe, go to:
https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce