CVE-2016-7146

Advisory

Moin 1.9.10 includes a security fix for CVE-2016-7146.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This version is still Python 1.5.2 compatible, but it's not extensivelytested for that version and some parts of the system might not workthere, especially seldom used macros and actions. Bug reports welcome!New features: * "deprecated" processing instruction * config entry "SecurityPolicy" to allow for customized permissions (see "security.py" for more) * added distutils support * though not extensively tested, the standalone server now does POST requests, i.e. you can save pages; there are still problems with persistent global variables! It only works for Python >= 2.0. * "bang_meta" config variable and "!NotWikiWord" markup * "url_mappings" config variable to dynamically change URL prefixes (especially useful in intranets, when whole trees of externally hosted documents move around) * setting "mail_smarthost" and "mail_from" activates mailing features (sending login data on the UserPreferences page) * very useful for intranet developer wikis, a means to view pydoc documentation, formatted via a XSLT stylesheet, for details see http://purl.net/wiki/python/TeudViewer?module=MoinMoin.macro.TeudView or MoinMoin/macro/TeudView.py * "LocalSiteMap" action by Steve Howell <showellzipcon.com> * Added FOLDOC to intermap.txtBugfixes: * Full config defaults, import MoinMoin now works w/o moin_config.py * Better control over permissions with config.umask * Bugfix for a UNIX time billenium bug (affecting RecentChanges sorting and page diffs) * data paths with directory names containing dots caused problems-----------------------------------------------------------------------------

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7146
• https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html
• http://www.securityfocus.com/bid/94259
• http://www.ubuntu.com/usn/USN-3137-1
• http://www.debian.org/security/2016/dsa-3715