[Git][security-tracker-team/security-tracker][master] new mediawiki issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
17319325 by Moritz Muehlenhoff at 2026-10-02T13:58:19+02:00
new mediawiki issues

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,67 @@
+CVE-2026-102966
+	- mediawiki <unfixed>
+	NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
+	NOTE: https://phabricator.wikimedia.org/T432551
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347836 (master)
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347893 (REL1_43)
+CVE-2026-102967
+	- mediawiki <unfixed>
+	NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
+	NOTE: https://phabricator.wikimedia.org/T431819
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347837 (master)
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347886 (REL1_43)
+CVE-2026-102968
+	- mediawiki <unfixed>
+	NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
+	NOTE: https://phabricator.wikimedia.org/T431819
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347838 (master)
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347887 (REL1_43)
+CVE-2026-102969
+	- mediawiki <not-affected> (Introduced in 1.46.x)
+	NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
+	NOTE: https://phabricator.wikimedia.org/T434189
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347839 (master)
+CVE-2026-102970
+	- mediawiki <unfixed>
+	NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
+	NOTE: https://phabricator.wikimedia.org/T434278
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347840 (master)
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347894 (REL1_43)
+CVE-2026-102971
+	- mediawiki <unfixed>
+	NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
+	NOTE: https://phabricator.wikimedia.org/T434521
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347841 (master)
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347888 (REL1_43)
+CVE-2026-102972
+	- mediawiki <unfixed>
+	NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
+	NOTE: https://phabricator.wikimedia.org/T120386
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347842 (master)
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347889 (REL1_43)
+CVE-2026-102973
+	- mediawiki <unfixed>
+	NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
+	NOTE: https://phabricator.wikimedia.org/T435022
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347843 (master)
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347890 (REL1_43)
+CVE-2026-102975
+	- mediawiki <unfixed>
+	NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
+	NOTE: https://phabricator.wikimedia.org/T435026
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347845 (master)
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347891 (REL1_43)
+CVE-2026-102974
+	- mediawiki <unfixed>
+	NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
+	NOTE: https://phabricator.wikimedia.org/T435457
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347844 (master)
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1347892 (REL1_43)
+CVE-2026-102977
+	- mediawiki <not-affected> (Introduced in 1.46.x)
+	NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/
+	NOTE: https://phabricator.wikimedia.org/T434372
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1347830 (master)
 CVE-2026-XXXX [MFA auth receipt and TOTP are not invalidated after use, allowing replay attacks]
 	- keystone 2:30.0.0~rc1-2 (bug #1149305)
 	NOTE: https://bugs.launchpad.net/keystone/+bug/2157347


=====================================
data/dsa-needed.txt
=====================================
@@ -82,6 +82,8 @@ linux (carnil)
 --
 lxd
 --
+mediawiki (jmm)
+--
 nagios4
 --
 nats-server



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/17319325d285fa248c16c7c2100cbbc69ea6e73e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/17319325d285fa248c16c7c2100cbbc69ea6e73e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/9c3ca2be/attachment.htm>