mediawiki: CVE-2014-9277

Debian Bug report logs - #772764
mediawiki: CVE-2014-9277

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Sebastien Delafond <seb@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: mediawiki: CVE-2014-9277

Date: Wed, 10 Dec 2014 22:05:57 +0100

Package: mediawiki
Severity: important
Tags: security upstream

The <cross-domain-policy> mangling in OutputHandler.php poses a
potentially severe security problem for API clients written in PHP, in
that format=php is affected. See the following URL for more details:

  https://phabricator.wikimedia.org/T73478

Cheers,

--Seb

Message #14 received at 772764@bugs.debian.org (full text, mbox, reply):

From: Джонатан Вашингтон <dzhonw@mail.ru>

To: 772764@bugs.debian.org

Subject: breaks API

Date: Mon, 15 Dec 2014 14:33:22 -0500

This patch also appears to break the API.

The following lines

        if ( preg_match( &#039;/\<\s*cross-domain-policy\s*\>/i&#039;,
$json ) ) {
            $json = preg_replace(
                &#039;/\<(\s*cross-domain-policy\s*)\>/i&#039;,
&#039;\03C$1\03E&#039;, $json
            );
        }

should be

        if ( preg_match( '/\<\s*cross-domain-policy\s*\>/i', $json ) ) {
            $json = preg_replace(
                '/\<(\s*cross-domain-policy\s*)\>/i', '\03C$1\03E', $json
            );
        }

Otherwise the API returns 500 errors and the following appears in the error log:
[error] PHP Fatal error: Call-time pass-by-reference has been removed
in /usr/share/mediawiki/includes/api/ApiFormatJson.php on line 77

Fix was identified by the friendly folks in freenode#mediawiki :)

-- 
Jonathan

Message #19 received at 772764@bugs.debian.org (full text, mbox, reply):

From: Merlijn van Deen <valhallasw@arctus.nl>

To: 772764@bugs.debian.org

Subject: CVE-2014-9277_2.patch breaks includes/api/ApiFormatJson.php / ApiFormatPhp.php

Date: Mon, 15 Dec 2014 20:35:12 +0100

[Message part 1 (text/plain, inline)]

Hello,

CVE-2014-9277_2.patch seems to contain htmlentities for quotes:

+ if ( preg_match( '/\<\s*cross-domain-policy\s*\>/i', $json ) ) {
+     $json = preg_replace(
+     '/\<(\s*cross-domain-policy\s*)\>/i&#039;,
&#039;\03C$1\03E&#039;, $json
+     );
+ }

which breaks both php files. Attached is a version where all &#039;'s
have been replaced by '.

Merlijn

[CVE-2014-9277_2.patch (application/octet-stream, attachment)]

Message #24 received at 772764@bugs.debian.org (full text, mbox, reply):

From: Sébastien Delafond <seb@debian.org>

To: 772764@bugs.debian.org

Subject: re: CVE-2014-9277_2.patch

Date: Wed, 17 Dec 2014 10:05:11 +0100

Thanks for the heads-up, this will be fixed shortly.

Cheers,

--Seb

Message #29 received at 772764@bugs.debian.org (full text, mbox, reply):

From: Sébastien Delafond <seb@debian.org>

To: 772764@bugs.debian.org

Subject: New debdiff

Date: Wed, 17 Dec 2014 10:18:57 +0100

[Message part 1 (text/plain, inline)]

You can find it attached.

Cheers,

--Seb

[mediawiki_CVE-2014-9277.debdiff (text/plain, attachment)]

Message #34 received at 772764-close@bugs.debian.org (full text, mbox, reply):

From: Sebastien Delafond <seb@debian.org>

To: 772764-close@bugs.debian.org

Subject: Bug#772764: fixed in mediawiki 1:1.19.20+dfsg-2.1

Date: Fri, 19 Dec 2014 09:35:03 +0000

Source: mediawiki
Source-Version: 1:1.19.20+dfsg-2.1

We believe that the bug you reported is fixed in the latest version of
mediawiki, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 772764@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sebastien Delafond <seb@debian.org> (supplier of updated mediawiki package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 14 Dec 2014 18:23:47 +0100
Source: mediawiki
Binary: mediawiki mediawiki-classes
Architecture: source all
Version: 1:1.19.20+dfsg-2.1
Distribution: unstable
Urgency: medium
Maintainer: Mediawiki Maintenance Team <pkg-mediawiki-devel@lists.alioth.debian.org>
Changed-By: Sebastien Delafond <seb@debian.org>
Description:
 mediawiki  - website engine for collaborative work
 mediawiki-classes - website engine for collaborative work - standalone classes
Closes: 772764
Changes:
 mediawiki (1:1.19.20+dfsg-2.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2014-9277: The <cross-domain-policy> mangling in OutputHandler.php
     poses a potentially severe security problem for API clients written in
     PHP, in that format=php is affected (Closes: #772764).
Checksums-Sha1:
 8e4cd4dcb7be95a4482b0ceacae852bf8bc54f34 1786 mediawiki_1.19.20+dfsg-2.1.dsc
 4de23cd0dc48d3bae685f9c914c83178284309e8 62812 mediawiki_1.19.20+dfsg-2.1.debian.tar.xz
 ebc5dca716480f8e9b12bd90d287920597b4ce2e 11767180 mediawiki_1.19.20+dfsg-2.1_all.deb
 fb1415b4f8519848f60a0883c2b56e41e4ec2e14 238560 mediawiki-classes_1.19.20+dfsg-2.1_all.deb
Checksums-Sha256:
 54996134afa9b5578893c52c05b85aa4c051a27b6fb1d66202311043434bbe1e 1786 mediawiki_1.19.20+dfsg-2.1.dsc
 bced0756dd6f54083f0bc88d3b9895d093e595c9db30bd474e7796964d72d603 62812 mediawiki_1.19.20+dfsg-2.1.debian.tar.xz
 421848f6492385e6d80c72721fcc589f65faf392c3534f8d476e04f2efa7eaf4 11767180 mediawiki_1.19.20+dfsg-2.1_all.deb
 6ed6437617490622b2a7f28237cc45c7147900168ed4a1a0ad4827f09dd75b55 238560 mediawiki-classes_1.19.20+dfsg-2.1_all.deb
Files:
 0d44ca868b6c13a9531578aa46942050 1786 web optional mediawiki_1.19.20+dfsg-2.1.dsc
 bbc955e0b9428a8d3b594caed572e202 62812 web optional mediawiki_1.19.20+dfsg-2.1.debian.tar.xz
 7ad6459af2d2a6e62878fbd6ee959bb9 11767180 web optional mediawiki_1.19.20+dfsg-2.1_all.deb
 e808dc36639dd4b1ec2128412e144734 238560 web optional mediawiki-classes_1.19.20+dfsg-2.1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJUkUlVAAoJEBC+iYPz1Z1kTdkH+gKty7b6B6/noBKMoXhxCMMg
0yZtQ1Y7zdPUv9Zqg7l1GcTNCwfzt0AVDACGyyUwHZ3xrBIWr3fTXbv0PhEinemr
UHJkgIsuFhyXymXjz+InggDTxmnaAUPCLYuLXlrR1cU5ioUZSdI2MLx/ne9FYFMn
rSrctbKs5WvWKrKuPtaByoTBDXQHtAiQtbEwlcs4OfdKAgcun4Mslxuo07xWpV0W
ERwLt7fmCZlEb5eTtzc9XtrjaTrjj1bzdsLTvBdUdEZ9JII3nPs0uePJpYRvm4tP
U/GvLiDLN5zqx07ya712n5dZ1zeP5Zy6XltX97Zv8s+L4O+pZXSCSwZZP4bqIy8=
=8YeZ
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.