-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2022-f83aec6d57 2022-09-09 11:21:56.289494 --------------------------------------------------------------------------------
Name : mediawiki Product : Fedora 36 Version : 1.37.4 Release : 1.fc36 URL : https://www.mediawiki.org/ Summary : A wiki engine Description : MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers
This package supports wiki farms. Read the instructions for creating wiki instances under /usr/share/doc/mediawiki/README.RPM. Remember to remove the config dir after completing the configuration.
-------------------------------------------------------------------------------- Update Information:
MediaWiki 1.37.4 This is a maintenance release of the MediaWiki 1.37 branch. Changes since MediaWiki 1.37.3 Localisation updates. (T311568) UploadBase::setTempFile() handle $tempPath being passed as null. (T311559) SpecialListFiles: user parameter isn't always present. (T311561) ImageListPager: Don't call htmlspecialchars() on null. (T311920) SpecialBlockList: Prevent passing null to trim(). (T311921) SpecialUserrights: Don't pass null to str_replace. (T311570) SpecialWithoutInterwiki: Don't pass null through to Title::capitalize(). (T311574, T311576) SpecialLinkSearch: Don't pass null through to the parser. (T312059) Update guzzlehttp/guzzle to 7.4.5 in vendor. (T296435, T297669) cache: Add four fields to LinkCache::getSelectFields. MediaWiki 1.37.3 This is a security and maintenance release of the MediaWiki 1.37 branch. Changes since MediaWiki 1.37.2 Localisation updates. (T289879) Type hints for ArrayAccess and JsonSerializable. (T304783) TemplateParser: avoid warnings when called by NoLocalSettings. Rebuilt vendor with composer 2.3.3. Fix old_name in UserLogoutComplete hook. (T289879) Address some deprecations for PHP 8.1. (T193565) UserGroupManager: Fix dbDomain in addUserToGroup() deferred update. (T309114) LocalFile::prerenderThumbnails: Limit the number of thumbnail jobs triggered. (T307982) Updated wikimedia/parsoid from v0.14.0 to v0.14.1. (T308471) SECURITY: Escape welcomeuser message passed to showSuccessPage(). (T308473) SECURITY: Escape contributions-title msg for use within page title. (T311272) Call parent constructor of AddSite maintenance script first. MediaWiki: Don't eagerly initialize action name. Updated wikimedia/shellbox from v2.0.0 to v2.1.1. (T311384, CVE-2022-27776) Updated guzzlehttp/guzzle from 7.2.0 to 7.4.5. (T289926) Avoid passing null to trim() in SkinTemplate. (T311473) rollbackEdits: Pass user identity to RollbackPage. (T307282) Avoid passing null to strcasecmp(), for PHP 8.1. (T311551) ShellboxClientFactory::getUrl(): Check if $this->key is null. (T311552) ChangesListSpecialPage: Don't pass null to FormatJson::decode(). (T311569) FileBackend::isStoragePath() Handle being passed null. (T311544) Pass int to ApiUsageException::newWithMessage()'s $httpCode param. (T311678) SpecialEditWatchlist: Prevent passing null to strtolower(). (T281741) ChangeTags: Fix adding CSS classes for hidden tags. (T296642) changetags: Fix management of a '0' tag. (T311554) ChangeTags: Return early in formatSummaryRow() if $tags === null. (T303033) Handle null in ChangeTags::modifyDisplayQuery. Updated wikimedia/common-passwords from 0.3.0 to 0.4.0. -------------------------------------------------------------------------------- ChangeLog:
* Thu Sep 1 2022 Michael Cronenworth mike@cchtml.com - 1.37.4-1 - Update to 1.37.4 - https://www.mediawiki.org/wiki/Release_notes/1.37#MediaWiki_1.37.4 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2101639 - MediaWiki 1.37.2 pulls in version of dependency (Parsoid 0.14.0) broken with PHP 8.1 https://bugzilla.redhat.com/show_bug.cgi?id=2101639 [ 2 ] Bug #2102955 - mediawiki-1.38.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2102955 [ 3 ] Bug #2112771 - CVE-2022-34911 mediawiki: Cross-site Scripting [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2112771 [ 4 ] Bug #2112773 - CVE-2022-34912 mediawiki: Username not escaped in the contributions-title message [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2112773 --------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-f83aec6d57' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------