--- Begin Message ---
Source: wordpress
Version: 5.4+dfsg1-1
Severity: grave
Tags: security upstream
Justification: user security hole
Hi,
The following vulnerabilities were published for wordpress.
Fortunately this time additionally to [6], there are GHSA advisories
associated with each of this CVEs (advantage of hosting a project on
github I would say :)). Now they list some ranges of affected
versions, and I'm interested to track which are actually not affecting
buster and stretch. Could you check if those are actually acurate? For
example CVE-2020-11030 lists via the GHSA as affected versions 5.2 to
5.4, and patched in 5.4.1, 5.3.3 and 5.2.6. Is this correct so which
would mean buster and stretch are not affected?
CVE-2020-11025[0]:
| In affected versions of WordPress, a cross-site scripting (XSS)
| vulnerability in the navigation section of Customizer allows
| JavaScript code to be executed. Exploitation requires an authenticated
| user. This has been patched in version 5.4.1, along with all the
| previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5,
| 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27,
| 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVE-2020-11026[1]:
| In affected versions of WordPress, files with a specially crafted name
| when uploaded to the Media section can lead to script execution upon
| accessing the file. This requires an authenticated user with
| privileges to upload files. This has been patched in version 5.4.1,
| along with all the previously affected versions via a minor release
| (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21,
| 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVE-2020-11027[2]:
| In affected versions of WordPress, a password reset link emailed to a
| user does not expire upon changing the user password. Access would be
| needed to the email account of the user by a malicious party for
| successful execution. This has been patched in version 5.4.1, along
| with all the previously affected versions via a minor release (5.3.3,
| 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22,
| 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVE-2020-11028[3]:
| In affected versions of WordPress, some private posts, which were
| previously public, can result in unauthenticated disclosure under a
| specific set of conditions. This has been patched in version 5.4.1,
| along with all the previously affected versions via a minor release
| (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21,
| 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVE-2020-11029[4]:
| In affected versions of WordPress, a vulnerability in the stats()
| method of class-wp-object-cache.php can be exploited to execute cross-
| site scripting (XSS) attacks. This has been patched in version 5.4.1,
| along with all the previously affected versions via a minor release
| (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21,
| 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVE-2020-11030[5]:
| In affected versions of WordPress, a special payload can be crafted
| that can lead to scripts getting executed within the search block of
| the block editor. This requires an authenticated user with the ability
| to add content. This has been patched in version 5.4.1, along with all
| the previously affected versions via a minor release (5.3.3, 5.2.6,
| 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23,
| 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2020-11025
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11025
[1] https://security-tracker.debian.org/tracker/CVE-2020-11026
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11026
[2] https://security-tracker.debian.org/tracker/CVE-2020-11027
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11027
[3] https://security-tracker.debian.org/tracker/CVE-2020-11028
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11028
[4] https://security-tracker.debian.org/tracker/CVE-2020-11029
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11029
[5] https://security-tracker.debian.org/tracker/CVE-2020-11030
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11030
[6]
https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates
Regards,
Salvatore
--- End Message ---
