Reporting Security Issues

If you have a security issue to report or even a security fix to propose, please contact ThomasWaldmann.

Security Fix Announcements

This page is intended for moin package maintainers, moin distributors (see also our Advisory for Distributors) and users interested in receiving security fix notifications.

(!) If you want to receive such notifications via email, just create a user account and subscribe to this page. You will receive an email as soon as someone updates this page.

For each version listed here, we will list important and rather current issues that got fixed after that release. See the page Security Fixes Installation for information on how to apply the fixes.

If this page gets too long over time, we will remove old version information (you can use info action to access this page's history) - if you are interested in security, you should not run stone-age software.

moin 1.9.11

moin 1.9.10

moin 1.9.9

  • Fixes security issues of 1.9.8.
  • XSS in GUI editor related code CVE-2017-5934

moin 1.9.8

  • XSS in AttachFile view (multifile related) CVE-2016-7148

  • XSS in GUI editor's attachment dialogue CVE-2016-7146
  • XSS in GUI editor's link dialogue CVE-2016-9119

Fixes issues found in 1.9.7.

moin 1.9.7

  • XSS in useragent event stats. Fix: http://hg.moinmo.in/moin/1.9/rev/7dd392e803fa

  • 1.9.7 improves security / admin tools for handling the security issues of moin <= 1.9.5:

    • 1.9.7 improves password hash security a lot by using passlib and sha512_crypt hashes
    • 1.9.7 also adds tools to better deal with resetting/invalidating passwords, notifying users of this, forcing upgrade to more secure hashes for all users, see the resetpw script command.

moin 1.9.6

  • Fixes security issues of 1.9.5.

moin 1.9.5

Fixes security issues of 1.9.4.

moin 1.9.4

  • /!\ virtual group bug in ACL evaluation CVE-2012-4404 /!\

    • The bugfix is the small patch for MoinMoin/security/__init__.py.

    • The other (bigger) change is only for adding a new unit test to test for correct behaviour (optional).
    • Severity: IF you have groups / ACLs that trigger the issue, users might get wrong permissions within the wiki, e.g.:
      • read stuff they should not be allowed to read
      • modify/delete stuff they should not be allowed to modify/delete
      • change ACLs (or use other functionality that checks the "admin" capability) they should not be allowed to change
    • Workaround:
      • It depends on the ACLs and groups used in your wiki. For some cases, you won't be affected by the bug at all, for other cases it might be a lot of work to work around the issue.
      • You could use the detailled description linked above to implement YOUR workaround, but we do not recommend this.

      • (!) We recommend to just apply the patch to fix the issue or install a fixed version of moin (as soon as it is available)

Fixes security issues of 1.9.3.

moin 1.9.3

  • /!\ /!\ /!\ XSLT / 4suite issue (used by xslt parser) /!\ /!\ /!\

    • Filesystem access (read/write/overwrite arbitrary path/file as the moin process uid/gid) is possible using xslt/4suite.
    • This is kind of a "feature" of xslt/4suite, but of course you don't want that except maybe if you only have very trusted editors and run it in your intranet.
    • Work around (put this into wiki config): 
      •  allow_xslt = 0

    • allow_xslt = 0 is the default (so if you do not explicitly set it to a different value, it will be disabled and you are not affected)

    • xslt processing depends on 4suite being installed (so even if allow_xslt is trueish, it won't work if 4suite is not installed)
    • you can check whether you have content that wants to use xslt parser by doing a full-text search in your wiki for:
      • xslt

      • re:"\<\?xml"

    • As this issue is a feature of xslt/4suite, we can't do much about it (we already have it off-by-default, so users are safe-by-default).

    • We have documented that enabling xslt is very dangerous. If you have a better idea, contact ThomasWaldmann.

    • Thanks to Nicolas Gregoire of Agarri for discovering this xslt/4suite issue.

  • /!\ XSS issue in rst parser CVE-2011-1058

    • Fix: remove support for javascript: URLs in the rst parser (dangerous, XSS)

    • rst is not the default parser of moin, but available if you have docutils installed.

    • If you don't use #format rst (or have rst as default markup), you can work around the issue by:

      • either removing MoinMoin/parser/text_rst.py (that makes rst unavailable)

      • or deinstalling docutils (that makes rst unavailable also)

      • watching changes (diffs) on format rst pages carefully, reverting suspect edits using info action and then revert to a known good version

Fixes security issues of 1.9.2.

moin 1.9.2

Fixes security issues of moin 1.9.1:

  • 1.9.2 fixes CVE-2010-0669.
  • 1.9.2 fixes CVE-2010-0668 (and also CVE-2010-0717 which is just another sub-issue of the same issue)

moin 1.9.1

  • /!\ CVE-2010-0669 potential security issue due to incomplete user profile input sanitizing, Affected: all up to 1.9.1

    • see superuser configuration hint below

  • /!\ CVE-2010-0668 major security issues were discovered. Some tips for working around the issues.

    • Do not have any user names in your superuser list (superuser list is used to give some users special powers). Affected: 1.5.x ... 1.9.1. 
       superuser = [] # or, even better: just remove superuser definition from all your wiki and farm configs

    • Exclude (disable) xmlrpc and SyncPages actions.

      • xmlrpc is usually used to access the wiki by scripts over the network, it is disabled by default. Affected: all up to 1.9.1

      • SyncPages is usually used for synchronizing wiki content with other wikis. Affected: 1.6.x ... 1.9.1 

       actions_excluded = ['xmlrpc', 'MyPages', 'CopyPage', 'SyncPages', ] # MyPages/CopyPage are there due to other concerns.
    • Do not use OpenID auth code (affected: 1.7.x .. 1.9.1, it is not used by default). 
       auth = [...] # <-- you should not have openid stuff there (also ok if you do not have any auth configured)
  • 1.9.1 fixes CVE-2010-0667.

moin 1.9.0

  • /!\ CVE-2010-0667 Found major security issue in moin 1.9.0 (versions before 1.9 are not affected). If you use 1.9.0, please upgrade to 1.9.1 immediately (1.9.1 has a fix for the issue). More details will follow later. /!\

moin versions < 1.9.x

MoinMoin versions older than 1.9.x are not maintained by MoinMoin developers any more.

Thus, they have to be considered vulnerable (except if you specifically know that someone else is really caring for security maintenance).

If you still run an old moin, you should upgrade to 1.9.<latest>.

See the docs folder in the moin download archive for upgrade instructions. If you have troubles while upgrading, don't give up, just contact us for Support.

Note: running moin 1.9.x will also be a requirement for upgrading to moin 2 (after it is released).

MoinMoin: SecurityFixes (last edited 2020年11月08日 18:14:55 by ThomasWaldmann )

AltStyle によって変換されたページ (->オリジナル) /