X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/2acafb8b3fc4dc2e061a1f811610f67a67c7358b..0b01e4f7b288077e9da1ac1743cec4af86dbe0ab:/doc/security.mdwn?ds=inline diff --git a/doc/security.mdwn b/doc/security.mdwn index a05adb8a4..6d68fac00 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -178,7 +178,8 @@ the same standards as the rest of ikiwiki, but with that said, here are some security notes for them. * The [[plugins/img]] plugin assumes that imagemagick/perlmagick are secure - from malformed image attacks. Imagemagick has had security holes in the + from malformed image attacks for at least the formats listed in + `img_allowed_formats`. Imagemagick has had security holes in the past. To be able to exploit such a hole, a user would need to be able to upload images to the wiki. @@ -507,4 +508,36 @@ and the fixed version 3.20150329 was released on the 29th. A fix was backported to Debian jessie as version 3.20141016.2 and to Debian wheezy as version 3.20120629.2. An upgrade is recommended for sites using CGI and openid. -onet +## XSS via error messages + +CGI error messages did not escape HTML meta-characters, potentially +allowing an attacker to carry out cross-site scripting by directing a +user to a URL that would result in a crafted ikiwiki error message. This +was discovered on 4 May by the ikiwiki developers, and the fixed version +3.20160506 was released on 6 May. The same fixes were backported to Debian +8 "jessie" in version 3.20141016.3. A backport to Debian 7 "wheezy" is +in progress. + +An upgrade is recommended for sites using +the CGI. ([[!cve CVE-2016-4561]], OVE-20160505-0012) + +## ImageMagick CVE-2016–3714 ("ImageTragick") + +ikiwiki 3.20160506 and 3.20141016.3 attempt to mitigate +[[!cve CVE-2016-3714]], and any +future ImageMagick vulnerabilities that resemble it, by restricting the +image formats that the [[ikiwiki/directive/img]] directive is willing to +resize. An upgrade is recommended for sites where an untrusted user is +able to attach images. Upgrading ImageMagick to a version where +CVE-2016-3714 has been fixed is also recommended, but at the time of +writing no such version is available. + +## Perl CVE-2016-1238 (current working directory in search path) + +ikiwiki 3.20160728 attempts to mitigate [[!cve CVE-2016-1238]] by +removing `'.'` from the Perl library search path. An attacker with write +access to ikiwiki's current working directory could potentially use this +vulnerability to execute arbitrary Perl code. An upgrade is recommended +for sites where an untrusted user is able to attach files with arbitrary +names and/or run a setuid ikiwiki wrapper with a working directory of +their choice.