From: Joey Hess Date: Mon, 30 Mar 2015 15:31:59 +0000 (-0400) Subject: update for recent XSS X-Git-Tag: 3.20150610~121 X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/commitdiff_plain/02f745a6755e063e921385bbbdcee02469f57269 update for recent XSS --- diff --git a/doc/security.mdwn b/doc/security.mdwn index afefd1bc3..6488d7f9e 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -497,3 +497,12 @@ Raúl Benencia discovered an additional XSS exposure in the meta plugin. This hole was discovered on 16 May 2012 and fixed the same day with the release of ikiwiki 3.20120516. A fix was backported to Debian squeeze, as version 3.20100815.9. An upgrade is recommended for all sites. + +## XSS via openid selector + +Raghav Bisht discovered this XSS in the openid selector. + +The hole was reported on March 24th, a fix was developed on March 27th, +and the fixed version was released on the 29th. A fix was backported +to Debian wheezy as version 3.20141016.2. An upgrade is recommended for +sites using CGI and openid.