====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN239
_____________________________________________________________________

DATE                : 04/05/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running WordPress versions prior to 5.4.1.

=====================================================================
https://wordpress.org/news/2020/04/wordpress-5-4-1/
_____________________________________________________________________


WordPress 5.4.1


Posted April 29, 2020 by Jake Spurlock. Filed under Releases, Security.


WordPress 5.4.1 is now available!

This security and maintenance release features 17 bug fixes in addition
to 7 security fixes. Because this is a security release, it is
recommended that you update your sites immediately. All versions since
WordPress 3.7 have also been updated.


WordPress 5.4.1 is a short-cycle security and maintenance release. The
next major release will be version 5.5.

You can download WordPress 5.4.1 by downloading from WordPress.org, or
visit your Dashboard → Updates and click Update Now.

If you have sites that support automatic background updates, they’ve
already started the update process.


Security Updates

Seven security issues affect WordPress versions 5.4 and earlier. If you
haven’t yet updated to 5.4, all WordPress versions since 3.7 have also
been updated to fix the following security issues:


    Props to Muaz Bin Abdus Sattar and Jannes who both independently
reported an issue where password reset tokens were not properly
invalidated

    Props to ka1n4t for finding an issue where certain private posts can
be viewed unauthenticated

    Props to Evan Ricafort for discovering an XSS issue in the
Customizer

    Props to Ben Bidner from the WordPress Security Team who discovered
an XSS issue in the search block

    Props to Nick Daugherty from WordPress VIP / WordPress Security Team
who discovered an XSS issue in wp-object-cache

    Props to Ronnie Goodrich (Kahoots) and Jason Medeiros who
independently reported an XSS issue in file uploads.

    Props to Weston Ruter for fixing a stored XSS vulnerability in the
WordPress customizer.

    Additionally, an authenticated XSS issue in the block editor was
discovered by Nguyen The Duc (ducnt) in WordPress 5.4 RC1 and RC2. It
was fixed in 5.4 RC5. We wanted to be sure to give credit and thank them
for all of their work in making WordPress more secure.

Thank you to all of the reporters for privately disclosing the
vulnerabilities. This gave the security team time to fix the
vulnerabilities before WordPress sites could be attacked.

For more information, browse the full list of changes on Trac, or check
out the version 5.4.1 HelpHub documentation page.

In addition to the security researchers mentioned above, thank you to
everyone who helped make WordPress 5.4.1 happen:

Alex Concha, Andrea Fercia, Andrew Duthie, Andrew Ozz, Andy Fragen, Andy
Peatling, arnaudbroes, Chris Van Patten, Daniel Richards, DhrRob,
Dono12, dudo, Ehtisham Siddiqui, Ella van Durpe, Garrett Hyder, Ian
Belanger, Ipstenu (Mika Epstein), Jake Spurlock, Jb Audras, John
Blackbourn, John James Jacoby, Jonathan Desrosiers, Jorge Costa, K. Adam
White, Kelly Choyce-Dwan, MarkRH, mattyrob, Miguel Fonseca, Mohammad
Jangda, Mukesh Panchal, Nick Daugherty, noahtallen, Paul Biron, Peter
Westwood, Peter Wilson, pikamander2, r-a-y, Riad Benguella, Robert
Anderson, Samuel Wood (Otto), Sergey Biryukov, Søren Brønsted, Stanimir
Stoyanov, tellthemachines, Timothy Jacobs, Toro_Unit (Hiroshi Urabe),
treecutter, and yohannp.



=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================