Source: wordpress Version: 5.4+dfsg1-1 Severity: grave Tags: security upstream Justification: user security hole
Hi, The following vulnerabilities were published for wordpress. Fortunately this time additionally to [6], there are GHSA advisories associated with each of this CVEs (advantage of hosting a project on github I would say :)). Now they list some ranges of affected versions, and I'm interested to track which are actually not affecting buster and stretch. Could you check if those are actually acurate? For example CVE-2020-11030 lists via the GHSA as affected versions 5.2 to 5.4, and patched in 5.4.1, 5.3.3 and 5.2.6. Is this correct so which would mean buster and stretch are not affected? CVE-2020-11025[0]: | In affected versions of WordPress, a cross-site scripting (XSS) | vulnerability in the navigation section of Customizer allows | JavaScript code to be executed. Exploitation requires an authenticated | user. This has been patched in version 5.4.1, along with all the | previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, | 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, | 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). CVE-2020-11026[1]: | In affected versions of WordPress, files with a specially crafted name | when uploaded to the Media section can lead to script execution upon | accessing the file. This requires an authenticated user with | privileges to upload files. This has been patched in version 5.4.1, | along with all the previously affected versions via a minor release | (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, | 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). CVE-2020-11027[2]: | In affected versions of WordPress, a password reset link emailed to a | user does not expire upon changing the user password. Access would be | needed to the email account of the user by a malicious party for | successful execution. This has been patched in version 5.4.1, along | with all the previously affected versions via a minor release (5.3.3, | 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, | 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). CVE-2020-11028[3]: | In affected versions of WordPress, some private posts, which were | previously public, can result in unauthenticated disclosure under a | specific set of conditions. This has been patched in version 5.4.1, | along with all the previously affected versions via a minor release | (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, | 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). CVE-2020-11029[4]: | In affected versions of WordPress, a vulnerability in the stats() | method of class-wp-object-cache.php can be exploited to execute cross- | site scripting (XSS) attacks. This has been patched in version 5.4.1, | along with all the previously affected versions via a minor release | (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, | 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). CVE-2020-11030[5]: | In affected versions of WordPress, a special payload can be crafted | that can lead to scripts getting executed within the search block of | the block editor. This requires an authenticated user with the ability | to add content. This has been patched in version 5.4.1, along with all | the previously affected versions via a minor release (5.3.3, 5.2.6, | 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, | 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2020-11025 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11025 [1] https://security-tracker.debian.org/tracker/CVE-2020-11026 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11026 [2] https://security-tracker.debian.org/tracker/CVE-2020-11027 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11027 [3] https://security-tracker.debian.org/tracker/CVE-2020-11028 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11028 [4] https://security-tracker.debian.org/tracker/CVE-2020-11029 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11029 [5] https://security-tracker.debian.org/tracker/CVE-2020-11030 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11030 [6] https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates Regards, Salvatore
