Merge branch 'master' into debian-jessie-backports

[git.ikiwiki.info.git] / doc / security.mdwn

diff --git a/doc/security.mdwn b/doc/security.mdwn
index d723826722fcbd558445f08f06b5417563bb1f15..055e1d006c50d76e145f084012101e24f195f46d 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -110,7 +110,7 @@ runs ikiwiki to update a given wiki. The wrapper can in turn be made suid,
 for example to be used in a [[post-commit]] hook by people who cannot write
 to the html pages, etc.
 
 for example to be used in a [[post-commit]] hook by people who cannot write
 to the html pages, etc.
 

-If the wrapper script is made suid, then any bugs in this wrapper would be
+If the wrapper program is made suid, then any bugs in this wrapper would be

 security holes. The wrapper is written as securely as I know how, is based
 on code that has a history of security use long before ikiwiki, and there's
 been no problem yet.
 security holes. The wrapper is written as securely as I know how, is based
 on code that has a history of security use long before ikiwiki, and there's
 been no problem yet.


@@ -178,7 +178,8 @@ the same standards as the rest of ikiwiki, but with that said, here are
 some security notes for them.
 
 * The [[plugins/img]] plugin assumes that imagemagick/perlmagick are secure
 some security notes for them.
 
 * The [[plugins/img]] plugin assumes that imagemagick/perlmagick are secure

-  from malformed image attacks. Imagemagick has had security holes in the
+  from malformed image attacks for at least the formats listed in
+  `img_allowed_formats`. Imagemagick has had security holes in the

   past. To be able to exploit such a hole, a user would need to be able to
   upload images to the wiki.
 
   past. To be able to exploit such a hole, a user would need to be able to
   upload images to the wiki.
 


@@ -484,10 +485,10 @@ for information disclosure via symlinks. ([[!cve CVE-2011-1408]])
 
 This hole was discovered on 8 June 2011 and fixed the same day with
 the release of ikiwiki 3.20110608. Note that the fix is dependant on
 
 This hole was discovered on 8 June 2011 and fixed the same day with
 the release of ikiwiki 3.20110608. Note that the fix is dependant on

-a version of su that has a similar hole fixed; [[!debbug 628843]]
-tracks fixing the hole in Debian's su. An upgrade is a must for any
-sites that have `ikiwiki-update-wikilist` installed suid (not the default),
-and whose admins run `ikiwiki-mass-rebuild`.
+a version of su that has a similar hole fixed. Version 4.1.5 of the shadow
+package contains the fixed su; [[!debbug 628843]] tracks fixing the hole in
+Debian. An upgrade is a must for any sites that have `ikiwiki-update-wikilist`
+installed suid (not the default), and whose admins run `ikiwiki-mass-rebuild`.

 
 ## javascript insertion via meta tags
 
 
 ## javascript insertion via meta tags
 


@@ -497,3 +498,36 @@ Raúl Benencia discovered an additional XSS exposure in the meta plugin.
 This hole was discovered on 16 May 2012 and fixed the same day with
 the release of ikiwiki 3.20120516. A fix was backported to Debian squeeze,
 as version 3.20100815.9. An upgrade is recommended for all sites.
 This hole was discovered on 16 May 2012 and fixed the same day with
 the release of ikiwiki 3.20120516. A fix was backported to Debian squeeze,
 as version 3.20100815.9. An upgrade is recommended for all sites.

+
+## XSS via openid selector
+
+Raghav Bisht discovered this XSS in the openid selector. ([[!cve CVE-2015-2793]])
+
+The hole was reported on March 24th, a fix was developed on March 27th,
+and the fixed version 3.20150329 was released on the 29th. A fix was backported
+to Debian jessie as version 3.20141016.2 and to Debian wheezy as version
+3.20120629.2. An upgrade is recommended for sites using CGI and openid.
+
+## XSS via error messages
+
+CGI error messages did not escape HTML meta-characters, potentially
+allowing an attacker to carry out cross-site scripting by directing a
+user to a URL that would result in a crafted ikiwiki error message. This
+was discovered on 4 May by the ikiwiki developers, and the fixed version
+3.20160506 was released on 6 May. The same fixes were backported to Debian
+8 "jessie" in version 3.20141016.3. A backport to Debian 7 "wheezy" is
+in progress.
+
+An upgrade is recommended for sites using
+the CGI. ([[!cve CVE-2016-4561]], OVE-20160505-0012)
+
+## ImageMagick CVE-2016–3714 ("ImageTragick")
+
+ikiwiki 3.20160506 and 3.20141016.3 attempt to mitigate
+[[!cve CVE-2016-3714]], and any
+future ImageMagick vulnerabilities that resemble it, by restricting the
+image formats that the [[ikiwiki/directive/img]] directive is willing to
+resize. An upgrade is recommended for sites where an untrusted user is
+able to attach images. Upgrading ImageMagick to a version where
+CVE-2016-3714 has been fixed is also recommended, but at the time of
+writing no such version is available.