[ASA-202107-7] mediawiki: access restriction bypass

[Jonas Witschel]

Arch Linux Security Advisory ASA-202107-7
=========================================

Severity: Medium
Date    : 2021-07-01
CVE-ID  : CVE-2021-35197
Package : mediawiki
Type    : access restriction bypass
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2093

Summary
=======

The package mediawiki before version 1.36.1-1 is vulnerable to access
restriction bypass.

Resolution
==========

Upgrade to 1.36.1-1.

# pacman -Syu "mediawiki>=1.36.1-1"

The problem has been fixed upstream in version 1.36.1.

Workaround
==========

None.

Description
===========

A security issue has been found in MediaWiki before version 1.36.1 that
allows blocked users to purge pages.

Impact
======

Blocked users could purge pages.

References
==========

https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/YR3X4L2CPSEJVSY543AWEO65TD6APXHP/
https://phabricator.wikimedia.org/T280226
https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/7fc84bbd23c1205e13c7a8332ab39e6ff52ca107%5E%21/
https://security.archlinux.org/CVE-2021-35197
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210703/35a5f7ce/attachment.sig>