==================================================================== CERT-Renater Note d'Information No. 2021/VULN345 _____________________________________________________________________ DATE : 02/07/2021 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running MediaWiki versions prior to 1.31.15, 1.35.3, 1.36.1. ===================================================================== https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/YR3X4L2CPSEJVSY543AWEO65TD6APXHP/ _____________________________________________________________________ Security and maintenance release: 1.31.15 / 1.35.3 / 1.36.1 Sam Reed 23 Jui 2021 18:18 I would like to announce the release of MediaWiki 1.31.15, 1.35.3 and 1.36.1! These releases also serve as a maintenance release for these branches. While tarballs have already been uploaded, git tags will follow later on today. An "MediaWiki Extensions Security Release Supplement" email will follow this one. It is also noted that the patch from MediaWiki 1.35.2 to MediaWiki 1.35.3 (mediawiki-1.35.3.patch.gz/mediawiki-1.35.3.patch.zip) is larger than expected due to an issue with the initial importing of skins and extensions as submodules into the REL1_35 branch; similar to what happened for 1.36.0. A bug has been filed for this issue, but doesn't cause any practical issues otherwise. == Security fixes == * (T280226, CVE-2021-35197) SECURITY: Prevent blocked users from purging pages. == Links to all mentioned tasks == * https://phabricator.wikimedia.org/T280226 == Release notes == Full release notes for 1.31.15: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_31/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.31 Full release notes for 1.35.3: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_35/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.35 Full release notes for 1.36.1: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_36/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.36 For information about how to upgrade, see ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.tar.gz https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.15.tar.gz https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.15.zip Patch to previous version (1.31.14): https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.patch.gz https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.15.tar.gz… https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.15.zip.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.zip.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.15.patch.zip.s… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.3.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.3.zip Patch to previous version (1.35.2): https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.patch.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.3.tar.gz.… https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.3.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.3.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.tar.gz https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.1.tar.gz https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.1.zip Patch to previous version (1.36.0): https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.patch.gz https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.1.tar.gz.… https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.1.zip.sig https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.zip.sig https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.1.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================