[prev in list] [next in list] [prev in thread] [next in thread] 

List:       wikitech-l
Subject:    [Wikitech-l] LdapAuthentication 2.0c - security release
From:       Ryan Lane <rlane32 () gmail ! com>
Date:       2012-08-31 18:00:22
Message-ID: CALKgCA3_E7-Cj9X3NCay=ET58zEkV+QUzFyw+Ri=XZ44LydvKg () mail ! gmail ! com
[Download RAW message or body]

This is an announcement of a security release of the
LdapAuthentication plugin. This release adds support for the fix
released in MediaWiki core in versions 1.19.2 and 1.18.5 that involved
data leakage, and false authentication in situations where the
LdapAuthentication extension was returning strict() as false.

The commit for this fix is: e67d0d392d261aa5a6b59f61dae4c42119aef2e3

The change-id in Gerrit is: I5244af48b895ebfb7ca79f04019924a172c417e4

It's also tagged in the git repo as 2.0c.

Additionally, after upgrading MediaWiki and the LdapAuthentication
extension, you should also purge leaked passwords from your local
database. Please see bug 39184
<https://bugzilla.wikimedia.org/show_bug.cgi?id=39184> for information
regarding purging the passwords.

- Ryan Lane

_______________________________________________
Wikitech-l mailing list
Wikitech-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
[prev in list] [next in list] [prev in thread] [next in thread]