Major security updates for Mahara

[François Marier]

Binary package hint: mahara

Here are packages to fix a number of very serious security issues in all versions of Mahara:

 * fixes to session key validation (CSRF)
 * privilege escalations
 * information disclosure in AJAX calls
 * https to http downgrade
 * sanitisation of HTML emails

[François Marier (fmarier)]

All of these patches were tested in their respective distro versions.

[François Marier (fmarier)]

Upstream advisories are here:

  http://mahara.org/interaction/forum/topic.php?id=3539
  http://mahara.org/interaction/forum/topic.php?id=3540
  http://mahara.org/interaction/forum/topic.php?id=3541
  http://mahara.org/interaction/forum/topic.php?id=3542
  http://mahara.org/interaction/forum/topic.php?id=3543

[Jamie Strandboge (jdstrand)]

Thanks for the patches!

Adding ubuntu-security-sponsors to subscribers as per https://wiki.ubuntu.com/SecurityTeam/SponsorsQueue (which is why this didn't show up on our reports and wasn't tended to yet).

[Jamie Strandboge (jdstrand)]

Oneiric has 1.3.6-1, which is not vulnerable.

[Marc Deslauriers (mdeslaur)]

Thanks for the debdiffs! Packages are building now and will be released today.