'[Wikitech-l] Security and maintenance release: 1.35.6 / 1.36.4 / 1.37.2'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       wikitech-l
Subject:    [Wikitech-l] Security and maintenance release: 1.35.6 / 1.36.4 / 1.37.2
From:       Sam Reed <reedy () wikimedia ! org>
Date:       2022-03-31 21:42:54
Message-ID: CAOCnLWZB+MWYHWXvqA3WdPrB+A-FDQnmYHVDQdXJ5a8f8imi+w () mail ! gmail ! com
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]


I would like to announce the release of MediaWiki 1.35.6, 1.36.4 and 1.37.2!

These releases also serve as a maintenance release for these branches.

This is expected to be the final release in the 1.36 branch, which is due
to become EOL as of the end of May 2022.

While tarballs have already been uploaded as of this e-mail, git tags will
follow later on today.

An "MediaWiki Extensions Security Release Supplement" e-mail will follow
this one, covering security updates for non-bundled extensions.

T297754 only applies to MediaWiki >= 1.37. Therefore fixes have not been
back-ported to 1.35 or 1.36.

Various patches aimed at PHP 8.0 and PHP 8.1 support have been back-ported
to all branches. This should fix a lot of log spam, and MediaWiki should
work on both versions.

Bug reports on PHP 8.0 and 8.1 are very welcome, and fixes will be
back-ported when possible. Please see
https://phabricator.wikimedia.org/tag/php_8.0_support/ and
https://phabricator.wikimedia.org/tag/php_8.1_support/ for the relevant
work boards.

== Security fixes ==
* (T297543, CVE-2022-28202) Messages widthheight/widthheightpage/nbytes not
escaped when used in galleries or Special:RevisionDelete.
* (T297571, CVE-2022-28201) Title::newMainPage() goes into an infinite
recursion loop if it points to a local interwiki.
* (T297731, CVE-2022-28203) Requesting Special:NewFiles on a wiki with many
file uploads with actor as a condition can result in a DoS.
* (T297754, CVE-2022-28204) Special:WhatLinksHere can result in a DoS when
a page is used on a extremely large number of other pages.

== Links to all mentioned tasks ==
* https://phabricator.wikimedia.org/T297543
* https://phabricator.wikimedia.org/T297571
* https://phabricator.wikimedia.org/T297731
* https://phabricator.wikimedia.org/T297754

== Release notes ==

Full release notes for 1.35.6:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_35/RELEASE-NOTES-1.35
https://www.mediawiki.org/wiki/Release_notes/1.35

Full release notes for 1.36.4:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_36/RELEASE-NOTES-1.36
https://www.mediawiki.org/wiki/Release_notes/1.36

Full release notes for 1.37.2:
https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_37/RELEASE-NOTES-1.37
https://www.mediawiki.org/wiki/Release_notes/1.37

For information about how to upgrade, see
<https://www.mediawiki.org/wiki/Manual:Upgrading>


**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.tar.gz
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.6.tar.gz
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.6.zip

Patch to previous version (1.35.5):
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.patch.gz
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.patch.zip

GPG signatures:
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.6.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.6.zip.sig
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.zip.sig
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.tar.gz
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.4.tar.gz
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.4.zip

Patch to previous version (1.36.3):
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.patch.gz
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.patch.zip

GPG signatures:
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.4.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.4.zip.sig
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.zip.sig
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

**********************************************************************
Download:
https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.tar.gz
https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.zip

Download without bundled extensions:
https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.2.tar.gz
https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.2.zip

Patch to previous version (1.37.1):
https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.patch.gz
https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.patch.zip

GPG signatures:
https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.2.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.2.zip.sig
https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.tar.gz.sig
https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.zip.sig
https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.patch.gz.sig
https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.patch.zip.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

[Attachment #5 (text/html)]

<div dir="ltr">I would like to announce the release of MediaWiki 1.35.6, 1.36.4 and \
1.37.2!<br><br>These releases also serve as a maintenance release for these \
branches.<br><br>This is expected to be the final release in the 1.36 branch, which \
is due to become EOL as of the end of May 2022.<br><br>While tarballs have already \
been uploaded as of this e-mail, git tags will follow later on today.<br><br>An \
&quot;MediaWiki Extensions Security Release Supplement&quot; e-mail will follow this \
one, covering security updates for non-bundled extensions.<br><br>T297754 only \
applies to MediaWiki &gt;= 1.37. Therefore fixes have not been back-ported to 1.35 or \
1.36.<br><br>Various patches aimed at PHP 8.0 and PHP 8.1 support have been \
back-ported to all branches. This should fix a lot of log spam, and MediaWiki should \
work on both versions.<br><br>Bug reports on PHP 8.0 and 8.1 are very welcome, and \
fixes will be back-ported when possible. Please see <a \
href="https://phabricator.wikimedia.org/tag/php_8.0_support/">https://phabricator.wikimedia.org/tag/php_8.0_support/</a> \
and <a href="https://phabricator.wikimedia.org/tag/php_8.1_support/">https://phabricator.wikimedia.org/tag/php_8.1_support/</a> \
for the relevant work boards.<br><br>== Security fixes ==<br>* (T297543, \
CVE-2022-28202) Messages widthheight/widthheightpage/nbytes not escaped when used in \
galleries or Special:RevisionDelete.<br>* (T297571, CVE-2022-28201) \
Title::newMainPage() goes into an infinite recursion loop if it points to a local \
interwiki.<br>* (T297731, CVE-2022-28203) Requesting Special:NewFiles on a wiki with \
many file uploads with actor as a condition can result in a DoS.<br>* (T297754, \
CVE-2022-28204) Special:WhatLinksHere can result in a DoS when a page is used on a \
extremely large number of other pages.<br><br>== Links to all mentioned tasks ==<br>* \
<a href="https://phabricator.wikimedia.org/T297543">https://phabricator.wikimedia.org/T297543</a><br>* \
<a href="https://phabricator.wikimedia.org/T297571">https://phabricator.wikimedia.org/T297571</a><br>* \
<a href="https://phabricator.wikimedia.org/T297731">https://phabricator.wikimedia.org/T297731</a><br>* \
<a href="https://phabricator.wikimedia.org/T297754">https://phabricator.wikimedia.org/T297754</a><br><br>== \
Release notes ==<br><br>Full release notes for 1.35.6:<br><a \
href="https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_35/RELEASE-NOTES-1.35 \
">https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_35/RELEASE-NOTES-1.35</a><br><a \
href="https://www.mediawiki.org/wiki/Release_notes/1.35">https://www.mediawiki.org/wiki/Release_notes/1.35</a><br><br>Full \
release notes for 1.36.4:<br><a \
href="https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_36/RELEASE-NOTES-1.36 \
">https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_36/RELEASE-NOTES-1.36</a><br><a \
href="https://www.mediawiki.org/wiki/Release_notes/1.36">https://www.mediawiki.org/wiki/Release_notes/1.36</a><br><br>Full \
release notes for 1.37.2:<br><a \
href="https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_37/RELEASE-NOTES-1.37 \
">https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_37/RELEASE-NOTES-1.37</a><br><a \
href="https://www.mediawiki.org/wiki/Release_notes/1.37">https://www.mediawiki.org/wiki/Release_notes/1.37</a><br><br>For \
information about how to upgrade, see<br>&lt;<a \
href="https://www.mediawiki.org/wiki/Manual:Upgrading">https://www.mediawiki.org/wiki/ \
Manual:Upgrading</a>&gt;<br><br><br>**********************************************************************<br>Download:<br><a \
href="https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.tar.gz">https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.tar.gz</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.zip">https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.zip</a><br><br>Download \
without bundled extensions:<br><a \
href="https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.6.tar.gz">https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.6.tar.gz</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.6.zip">https:/ \
/releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.6.zip</a><br><br>Patch to \
previous version (1.35.5):<br><a \
href="https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.patch.gz">https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.patch.gz</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.patch.zip">https: \
//releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.patch.zip</a><br><br>GPG \
signatures:<br><a href="https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1 \
.35.6.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.6.tar.gz.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.6.zip.sig">htt \
ps://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.6.zip.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.tar.gz.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.zip.sig">https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.zip.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.patch.gz.sig">htt \
ps://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.patch.gz.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.patch.zip.sig">ht \
tps://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.6.patch.zip.sig</a><br><br>Public \
keys:<br><a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/ \
keys/keys.html</a><br><br>**********************************************************************<br>Download:<br><a \
href="https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.tar.gz">https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.tar.gz</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.zip">https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.zip</a><br><br>Download \
without bundled extensions:<br><a \
href="https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.4.tar.gz">https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.4.tar.gz</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.4.zip">https:/ \
/releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.4.zip</a><br><br>Patch to \
previous version (1.36.3):<br><a \
href="https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.patch.gz">https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.patch.gz</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.patch.zip">https: \
//releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.patch.zip</a><br><br>GPG \
signatures:<br><a href="https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1 \
.36.4.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.4.tar.gz.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.4.zip.sig">htt \
ps://releases.wikimedia.org/mediawiki/1.36/mediawiki-core-1.36.4.zip.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.tar.gz.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.zip.sig">https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.zip.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.patch.gz.sig">htt \
ps://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.patch.gz.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.patch.zip.sig">ht \
tps://releases.wikimedia.org/mediawiki/1.36/mediawiki-1.36.4.patch.zip.sig</a><br><br>Public \
keys:<br><a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/ \
keys/keys.html</a><br><br>**********************************************************************<br>Download:<br><a \
href="https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.tar.gz">https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.tar.gz</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.zip">https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.zip</a><br><br>Download \
without bundled extensions:<br><a \
href="https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.2.tar.gz">https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.2.tar.gz</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.2.zip">https:/ \
/releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.2.zip</a><br><br>Patch to \
previous version (1.37.1):<br><a \
href="https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.patch.gz">https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.patch.gz</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.patch.zip">https: \
//releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.patch.zip</a><br><br>GPG \
signatures:<br><a href="https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1 \
.37.2.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.2.tar.gz.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.2.zip.sig">htt \
ps://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.2.zip.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.tar.gz.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.zip.sig">https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.zip.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.patch.gz.sig">htt \
ps://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.patch.gz.sig</a><br><a \
href="https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.patch.zip.sig">ht \
tps://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.2.patch.zip.sig</a><br><br>Public \
keys:<br><a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a><br></div>




_______________________________________________
Wikitech-l mailing list -- wikitech-l@lists.wikimedia.org
To unsubscribe send an email to wikitech-l-leave@lists.wikimedia.org
https://lists.wikimedia.org/postorius/lists/wikitech-l.lists.wikimedia.org/

[prev in list] [next in list] [prev in thread] [next in thread]
Configure | About | News | Add a list | Sponsored by KoreLogic