Mediawiki package vulnerable to CVE-2014-2665

[glance]

The mediawiki version in 14.04 is vulnerable to CVE-2014-2665.

Please either remove the package or upgrade it to whats carried in Utopic.

That bug makes the password recovery function unusable.

https://bugzilla.wikimedia.org/show_bug.cgi?id=62497

[Seth Arnold (seth-arnold)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Seth Arnold (seth-arnold)]

Our CVE tracker database shows that only 12.04 LTS is affected by this: http://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2014-2665

Is our database incorrect?

Thanks

[glance (glance-acc)]

Sorry, me misreading the mediawiki bug tracker. This is not CVE-2014-2665 , but the fix for that cve broke the password recovery function is intended to protect:
http://www.mediawiki.org/wiki/Thread:Project:Support_desk/Session_Hijacking_error_after_Update_1.19.14

But still, the mediawiki package is unpatched for CVE-2014-3966 , CVE-2014-5243 and CVE-2014-5241 , all of which is fixed in the utopic package.

[Launchpad Janitor (janitor)]

[Expired for mediawiki (Ubuntu) because there has been no activity for 60 days.]

[glance (glance-acc)]

Come on. Letting this expire is kinda harsh.

Either retract the package or update it.