cve id

diff --git a/debian/changelog b/debian/changelog
index 7a3f6061f09e7ab02956cf4bc8dbb40144405949..02796394b947a17225df72e4808c4bfc0955c9ed 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -11,7 +11,7 @@ ikiwiki (2.48) unstable; urgency=high
 
   * Fix security hole that occurred if openid and passwordauth were both
     enabled. passwordauth would allow logging in as a known openid, with an
 
   * Fix security hole that occurred if openid and passwordauth were both
     enabled. passwordauth would allow logging in as a known openid, with an

-    empty password. Closes: #483770
+    empty password. Closes: #483770 (CVE-2008-0169)

   * Add rel=nofollow to edit links. This may prevent some spiders from
     pounding on the cgi following edit links.
   * passwordauth: If Authen::Passphrase is installed, use it to store
   * Add rel=nofollow to edit links. This may prevent some spiders from
     pounding on the cgi following edit links.
   * passwordauth: If Authen::Passphrase is installed, use it to store

diff --git a/doc/news/version_2.48.mdwn b/doc/news/version_2.48.mdwn
index a0c52f4e8120708c546c2d791dbd42a5ef4a296a..76dbd7ddc340b20f590cae9df6fe9a60cdfd6e89 100644 (file)
--- a/doc/news/version_2.48.mdwn
+++ b/doc/news/version_2.48.mdwn
@@ -13,6 +13,7 @@ ikiwiki 2.48 released with [[toggle text="these changes"]]
    * Fix security hole that occurred if openid and passwordauth were both
      enabled. passwordauth would allow logging in as a known openid, with an
      empty password. Closes: #[483770](http://bugs.debian.org/483770)
    * Fix security hole that occurred if openid and passwordauth were both
      enabled. passwordauth would allow logging in as a known openid, with an
      empty password. Closes: #[483770](http://bugs.debian.org/483770)

+     (CVE-2008-0169)

    * Add rel=nofollow to edit links. This may prevent some spiders from
      pounding on the cgi following edit links.
    * passwordauth: If Authen::Passphrase is installed, use it to store
    * Add rel=nofollow to edit links. This may prevent some spiders from
      pounding on the cgi following edit links.
    * passwordauth: If Authen::Passphrase is installed, use it to store

diff --git a/doc/security.mdwn b/doc/security.mdwn
index b2e076ec4d8ece71f4c44cf53451e21734f5d902..57cac719f41c7bd0bba1f46e472f8a0e486327d8 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -403,7 +403,7 @@ passwords in cleartext over the net to log in, either.
 This hole allowed ikiwiki to accept logins using empty passwords, to openid
 accounts that didn't use a password. It was introduced in version 1.34, and
 fixed in version 2.48. The [bug](http://bugs.debian.org/483770) was
 This hole allowed ikiwiki to accept logins using empty passwords, to openid
 accounts that didn't use a password. It was introduced in version 1.34, and
 fixed in version 2.48. The [bug](http://bugs.debian.org/483770) was

-discovered on 30 May 2008 and fixed the same day.
+discovered on 30 May 2008 and fixed the same day. ([[cve CVE-2008-0169]])

 
 I recommend upgrading to 2.48 immediatly if your wiki allows both password
 and openid logins.
 
 I recommend upgrading to 2.48 immediatly if your wiki allows both password
 and openid logins.