Security pre-release announcement: 1.43.9 / 1.44.6 / 1.45.4

--===============3599493913418799417==
Content-Type: multipart/alternative; boundary="0000000000003f848c06551b78af"

--0000000000003f848c06551b78af
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi all,

On Monday (2026-06-29) we will be issuing a security and maintenance
release to all supported branches of MediaWiki.

Due to the complexity of various patches that will be released as part of
this, they will be made public in Gerrit before the tarballs and git tags
are made.

We have therefore referenced mitigations for some high severity issues both
in the referenced tickets and below.

It is strongly recommended to apply the mitigations to your MediaWiki
installs ASAP, before the patches are released.

While Timeline/EasyTimeline[2] is *not* a MW Bundled extension, it is used
on Wikimedia wikis and is also widely used across the MediaWiki
installation ecosystem; it is therefore flagged for your attention due to
the issues found. If you do not have this extension installed, you do not
need to do anything for that mitigation.

The new releases will be:
- 1.43.9
- 1.44.6
- 1.45.4

These security issues will also be included in 1.46.0, which is due to be
released afterwards.

Security issues:

MediaWiki Core: https://phabricator.wikimedia.org/T422244 - RCE

Mitigation patch:
Making use of $wgRevokePermissions [4], the following lines can be added to
your LocalSettings.php; it will temporarily disable all importing and
therefore prevent malicious files being imported by any user:

  $wgRevokePermissions['*']['importupload'] =3D true;
  $wgRevokePermissions['*']['import'] =3D true;

You will want to remove these lines once you have applied the security
patches/upgraded to the latest point release versions. We recommend that
you restrict imports to trusted users.

Non-bundled extension security issues:

Timeline: https://phabricator.wikimedia.org/T426631 - RCE

A Remote Code Execution vulnerability exists in the perl script that
EasyTimeline executes to render the timelines.

If you run EasyTimeline in a similar fashion to Wikimedia Production, where
EasyTimeline=E2=80=99s perl scripts are executed in a remote shellbox (vm o=
r
kubernetes), exposure is more limited.

Mitigation: Disable timeline (EasyTimeline) extension until patches are
released, especially if you do not run the execution in a remote shellbox.
Or if you have access to the security tasks, apply the patch from the task.

Timeline: https://phabricator.wikimedia.org/T427611 - Stored XSS in SVG
file output

It is possible to store an XSS in the SVG files generated by timeline.
These aren=E2=80=99t used by MediaWiki by default (though they may be used =
for RTL
timelines), but these files would still be hosted by your wiki, and could
be hot linked elsewhere.

Mitigation: Disable timeline (EasyTimeline) extension until patches are
released, especially if you do not run the execution in a remote shellbox.
Or if you have access to the security tasks, apply the patch from the task.

Appropriate CSP configuration can also help prevent XSS vectors such as
this.

=E2=80=94

This release will also resolve security issues in bundled extensions, along
with bug fixes included for maintenance reasons.

These security issues also affect many unsupported versions of MediaWiki.

We will make the fixes available in the respective release branches and
master in git. Tarballs will be available for the above mentioned point
releases as well.

A summary of some of the security fixes that have gone into non-bundled
MediaWiki extensions will also follow later.

As a reminder, MediaWiki 1.39 became EOL in December 2025 and MediaWiki
1.42 became EOL in June 2025.

MediaWiki 1.44 becomes EOL at the end of July 2026.

MediaWiki 1.46 is due to be released following this security release.

More information on these timelines can be viewed on the version lifecycle
page at [1].

Thank you,

Wikimedia Foundation, Product Safety and Integrity
[email protected]

[1] https://www.mediawiki.org/wiki/Version_lifecycle
[2] https://www.mediawiki.org/wiki/Extension:EasyTimeline
[3] https://www.mediawiki.org/wiki/Manual:Security#File_permissions
[4] https://www.mediawiki.org/wiki/Manual:$wgRevokePermissions

--0000000000003f848c06551b78af
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi all,<br><br>On Monday (2026-06-29) we will be issuing a=
 security and maintenance release to all supported branches of MediaWiki.<b=
r><br>Due to the complexity of various patches that will be released as par=
t of this, they will be made public in Gerrit before the tarballs and git t=
ags are made.<br><br>We have therefore referenced mitigations for some high=
 severity issues both in the referenced tickets and below.<br><br>It is str=
ongly recommended to apply the mitigations to your MediaWiki installs ASAP,=
 before the patches are released.<br><br>While Timeline/EasyTimeline[2] is =
*not* a MW Bundled extension, it is used on Wikimedia wikis and is also wid=
ely used across the MediaWiki installation ecosystem; it is therefore flagg=
ed for your attention due to the issues found. If you do not have this exte=
nsion installed, you do not need to do anything for that mitigation.<br><br=
>The new releases will be:<br>- 1.43.9<br>- 1.44.6<br>- 1.45.4<br><br>These=
 security issues will also be included in 1.46.0, which is due to be releas=
ed afterwards.<br><br>Security issues:<br><br>MediaWiki Core: <a href=3D"ht=
tps://phabricator.wikimedia.org/T422244">https://phabricator.wikimedia.org/=
T422244</a> - RCE<br><br>Mitigation patch:<br>Making use of $wgRevokePermis=
sions [4], the following lines can be added to your LocalSettings.php; it w=
ill temporarily disable all importing and therefore prevent malicious files=
 being imported by any user:<br><br>=C2=A0 $wgRevokePermissions[&#39;*&#39;=
][&#39;importupload&#39;] =3D true;<br>=C2=A0 $wgRevokePermissions[&#39;*&#=
39;][&#39;import&#39;] =3D true;<br><br>You will want to remove these lines=
 once you have applied the security patches/upgraded to the latest point re=
lease versions. We recommend that you restrict imports to trusted users.<br=
><br>Non-bundled extension security issues:<br><br>Timeline: <a href=3D"htt=
ps://phabricator.wikimedia.org/T426631">https://phabricator.wikimedia.org/T=
426631</a> - RCE<br><br>A Remote Code Execution vulnerability exists in the=
 perl script that EasyTimeline executes to render the timelines.<br><br>If =
you run EasyTimeline in a similar fashion to Wikimedia Production, where Ea=
syTimeline=E2=80=99s perl scripts are executed in a remote shellbox (vm or =
kubernetes), exposure is more limited.<br><br>Mitigation: Disable timeline =
(EasyTimeline) extension until patches are released, especially if you do n=
ot run the execution in a remote shellbox. Or if you have access to the sec=
urity tasks, apply the patch from the task.<br><br>Timeline: <a href=3D"htt=
ps://phabricator.wikimedia.org/T427611">https://phabricator.wikimedia.org/T=
427611</a> - Stored XSS in SVG file output<br><br>It is possible to store a=
n XSS in the SVG files generated by timeline. These aren=E2=80=99t used by =
MediaWiki by default (though they may be used for RTL timelines), but these=
 files would still be hosted by your wiki, and could be hot linked elsewher=
e.<br><br>Mitigation: Disable timeline (EasyTimeline) extension until patch=
es are released, especially if you do not run the execution in a remote she=
llbox. Or if you have access to the security tasks, apply the patch from th=
e task.<br><br>Appropriate CSP configuration can also help prevent XSS vect=
ors such as this.<br><br><div>=E2=80=94<br><br>This release will also resol=
ve security issues in bundled extensions, along with bug fixes included for=
 maintenance reasons.<br><br>These security issues also affect many unsuppo=
rted versions of MediaWiki.<br><br>We will make the fixes available in the =
respective release branches and master in git. Tarballs will be available f=
or the above mentioned point releases as well.<br><br>A summary of some of =
the security fixes that have gone into non-bundled MediaWiki extensions wil=
l also follow later.<br><br>As a reminder, MediaWiki 1.39 became EOL in Dec=
ember 2025 and MediaWiki 1.42 became EOL in June 2025.<br><br>MediaWiki 1.4=
4 becomes EOL at the end of July 2026.<div><br>MediaWiki 1.46 is due to be =
released following this security release.<br><br>More information on these =
timelines can be viewed on the version lifecycle page at [1].<br><br>Thank =
you,<br><br>Wikimedia Foundation, Product Safety and Integrity<br><a href=
=3D"mailto:[email protected]">[email protected]</a><br>=
<br>[1] <a href=3D"https://www.mediawiki.org/wiki/Version_lifecycle">https:=
//www.mediawiki.org/wiki/Version_lifecycle</a><br>[2] <a href=3D"https://ww=
w.mediawiki.org/wiki/Extension:EasyTimeline">https://www.mediawiki.org/wiki=
/Extension:EasyTimeline</a><br>[3] <a href=3D"https://www.mediawiki.org/wik=
i/Manual:Security#File_permissions">https://www.mediawiki.org/wiki/Manual:S=
ecurity#File_permissions</a><br>[4] <a href=3D"https://www.mediawiki.org/wi=
ki/Manual:$wgRevokePermissions">https://www.mediawiki.org/wiki/Manual:$wgRe=
vokePermissions</a><br class=3D"gmail-Apple-interchange-newline"></div></di=
v></div>

--0000000000003f848c06551b78af--

--===============3599493913418799417==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Wikitech-l mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://lists.wikimedia.org/postorius/lists/wikitech-l.lists.wikimedia.org/
--===============3599493913418799417==--