ALT-PU-2021-1991

Критический

ALT-PU-2021-1991: package mediawiki update to version 1.36.0-alt1

Источник

errata.altlinux.org

Дата публикации

12.06.2021

Дата обновления

04.02.2026

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades mediawiki to version 1.36.0-alt1.

Устраненные уязвимости23

BDU:2021-04474

Критический 9.8

Дата публикации: 10.09.2021

Уязвимость расширения Oauth программного средства для реализации гипертекстовой среды MediaWiki, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

CVSS 3.1

Критический 9.8

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS 2.0

Критический 10

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Ссылки

BDU:2021-04474 https://bdu.fstec.ru/vul/2021-04474

Ссылки1

ALT-PU-2021-1991 https://errata.altlinux.org/ALT-PU-2021-1991

Связанные уязвимости

CVE-2021-31545

CVSS3: 5.3

nvd

больше 5 лет назад

An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The page_recent_contributors leaked the existence of certain deleted MediaWiki usernames, related to rev_deleted.

GHSA-gjvq-jhqf-q4gj

github

больше 4 лет назад

An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The page_recent_contributors leaked the existence of certain deleted MediaWiki usernames, related to rev_deleted.

CVE-2021-31546

CVSS3: 4.3

nvd

больше 5 лет назад

An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly logged sensitive suppression deletions, which should not have been visible to users with access to view AbuseFilter log data.

GHSA-m6mr-cqmw-69c6

CVSS3: 4.3

github

больше 4 лет назад

CVE-2021-31547

CVSS3: 4.3

nvd

больше 5 лет назад

An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unprivileged users through the iteration of crafted AbuseFilter rules.