Ubuntu alert USN-8315-1 (mediawiki)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8315-1] MediaWiki vulnerabilities
Date:
             
 
Wed, 27 May 2026 13:35:42 +0000
Message-ID:
             
 
<E1wSEQA-0004Je-9o@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8315-1
May 27, 2026

mediawiki vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

MediaWiki could be made to expose sensitive information over the
network.

Software Description:
- mediawiki: The collaborative editing software that runs Wikipedia.

Details:

It was discovered that MediaWiki incorrectly handled group membership 
visibility in the OATHAuth extension. An authenticated attacker could 
use this issue to determine if other users had two-factor authentication 
enabled. (CVE-2026-34087)

It was discovered that MediaWiki incorrectly handled suppressed log entry 
titles in the RecentChanges list. An unauthenticated attacker could use 
this issue to view titles of deleted or suppressed pages that should be hidden.
(CVE-2026-34088)

It was discovered that MediaWiki incorrectly handled resource loading timing
information. An attacker could use this issue to determine if certain pages 
existed on a wiki. (CVE-2026-34092)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  mediawiki                       1:1.39.7-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  mediawiki                       1:1.35.6-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  mediawiki                       1:1.31.7-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8315-1
  CVE-2026-34087, CVE-2026-34088, CVE-2026-34092


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmoW8sgACgkQcpJm3tlz
hgGBVxAAm4uE49qqahVjufy6Y/XwCV8rn/G40XoD2lFtC5M3lqGlCEhxOAULUcYu
JMqFIAjjC8dwTX5neec7EaoZPw5f+e8gjwhYRj7FroF/7IEijYASgx9c83cdZiDV
Thny0gYrjIwYa0iyYVYHt7W8uMKsUA8eXlwXRXyl0fAFoxv2I/GOHzLQ4uA3pyoc
F9oqp6nzm6IMlS5aFeiPFrZtNVbs4j1JxrJf4+ZBFahrpYiFIq1AHIp68EevXhaZ
uGMeG+tl8QW6gpsjQsM4oxPx4rDt8FzWWqzG2OKaYXpNKaWQwwqpNdATMwTRnkYX
fQkbk5eTZ09VePdRJ93op+iXSdvnXYLlkSBUXONmSsPl2DcyQ6/fUNELhCQlnoZb
y8ko3ZjUoaf7uExs2KEQhPx7MPxUToUr8CRTezHF4+zkeJzc1QuQtgIkuBFKPSaX
K5LwZn5kS3qJHF3U7xN55meGYbsRKhG0hu9AEnhbOdd2baahVUTPkCIQBxr3rVQO
Pu4gZcgmZtgr7myoLRBPCw+epGFdEJljnA7TBNQcqhDCVa4xmGj7JtCJdq+ROjTl
HvRjlk/HofERj/GNXcbVPS6TwNA+GVKVfirmcFyy6+wZHhR5DD+6vId3oPVSyLqQ
3A86LcUtsUNAmXg+B4WAJFNJqV4GtOMNZyE6fRcPiUiF5fIrGLA=
=+ujM
-----END PGP SIGNATURE-----