Arch Linux alert ASA-202107-7 (mediawiki)

From:
             
 
Jonas Witschel via arch-security <arch-security@lists.archlinux.org>
To:
             
 
arch-security@lists.archlinux.org
Subject:
             
 
[ASA-202107-7] mediawiki: access restriction bypass
Date:
             
 
Sat, 03 Jul 2021 18:25:13 +0200
Message-ID:
             
 
<20210703162513.sprqzxuqkhcij45u@archlinux.org>
Cc:
             
 
Jonas Witschel <diabonas@archlinux.org>
Arch Linux Security Advisory ASA-202107-7
=========================================

Severity: Medium
Date    : 2021-07-01
CVE-ID  : CVE-2021-35197
Package : mediawiki
Type    : access restriction bypass
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2093

Summary
=======

The package mediawiki before version 1.36.1-1 is vulnerable to access
restriction bypass.

Resolution
==========

Upgrade to 1.36.1-1.

# pacman -Syu "mediawiki>=1.36.1-1"

The problem has been fixed upstream in version 1.36.1.

Workaround
==========

None.

Description
===========

A security issue has been found in MediaWiki before version 1.36.1 that
allows blocked users to purge pages.

Impact
======

Blocked users could purge pages.

References
==========

https://lists.wikimedia.org/hyperkitty/list/mediawiki-ann...
https://phabricator.wikimedia.org/T280226
https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/...
https://security.archlinux.org/CVE-2021-35197