September 2023 - TOPF

[MediaWiki-announce] Maintenance release: MediaWiki 1.35.13

by Sam Reed

I would like to announce the availability of MediaWiki 1.35.13 This fixes an issue identified in the MediaWiki 1.35.13 release. The patch for T341529 was incorrectly back-ported, which would result in an error relating to some diffs. If you use git tags, 1.35.12 and 1.35.13 are basically identical (bar RELEASE-NOTES and a version bump), due to how the issue was resolved to get the patches through CI. If you use the tarballs and patches, as the patches are created against the uploaded tarballs (not re-created versions from the git tags), the patch will resolve the issue mentioned above. ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.13.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.13.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.13.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.13.zip Patch to previous version (1.35.12): https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.13.patch.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.13.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.13.tar.... https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.13.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.13.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.13.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.13.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.13.patch.zip... Public keys: https://www.mediawiki.org/keys/keys.html _______________________________________________ MediaWiki-announce mailing list -- mediawiki-announce(a)lists.wikimedia.org To unsubscribe send an email to mediawiki-announce-leave(a)lists.wikimedia.org

2 Jahre

1
0
0 / 0

[MediaWiki-announce] Security and maintenance release: 1.35.12 / 1.39.5 / 1.40.1

by Sam Reed

I would like to announce the release of MediaWiki 1.35.12, 1.39.5 and 1.40.1! These releases also serve as a maintenance release for these branches. The tarballs have already been uploaded as of this email, and the git tags have been pushed. Unfortunately at the time of finalising this release, none of our CVEs have been assigned a tracking number by MITRE. To get these releases out as detailed in the pre-release announcement, they are therefore documented as "CVE-2023-PENDING" here and in the commit messages of the commits that will be pushed. The related tasks will be updated in retrospect when the CVEs are issued, and we will also amend the RELEASE-NOTES files. They will then be retrospectively correctly documented in the next releases, and in HISTORY in the master branch of MediaWiki core. Two of the referenced tasks and their applicable security fixes were not counted in the pre-release announcement. Notes about specific CVEs: T333050 was merged in public after the 1.35.11/1.38.7/1.39.4 and 1.40.0 releases. T264765 was merged in public before the 1.39.5/1.40.1 releases, and would affect 1.36 onwards. T340217 only applies to Vector 2022 in 1.40. T340220 would affect 1.38 onwards, but is not being fixed in 1.38 due to that branch being unsupported since June 2023. T340221 and T341529 are applied to all supported branches, but would also affect numerous unsupported branches. T341565 against CVE-2023-3550 was made public on a third party platform before the reporters' own timeline (as disclosed to the Wikimedia Foundation), and also without approval from ourselves. MediaWiki provides no support for displaying/rendering these XML files. MediaWiki in a default configuration is not vulnerable to this issue; 'xml' would have had to be added to '$wgFileExtensions' in LocalSettings.php. It continues to be strongly recommended not to enable uploading XML files (via Special:Upload etc.; not via Special:Import). SVG files are not affected. If you need to allow XML file upload (for some reason), you will now have to remove 'xml' from '$wgProhibitedFileExtensions' and the xml entries from '$wgMimeTypeExclusions' (in 1.35, from '$wgFileBlacklist' and '$wgMimeTypeBlacklist' respectively). While it is strongly not recommended to enable the upload of XML files, if you need to allow this for some reason, it is very much strongly suggested you only allow uploads from users that you trust, and that they only upload files from trusted sources. See https://www.mediawiki.org/wiki/Manual:$wgProhibitedFileExtensions and https://www.mediawiki.org/wiki/Manual:$wgProhibitedFileExtensions for more information about how these mechanisms work. A "MediaWiki Extensions Security Release Supplement" e-mail will follow this one, covering security updates for non-bundled extensions. Various patches aimed at PHP 8.0, 8.1, and 8.2 support have been back-ported. Reports of bugs with PHP 8.0, 8.1, 8.2 and 8.3 support are particularly welcome, and fixes will be back-ported when possible. Please see https://phabricator.wikimedia.org/tag/php_8.0_support/, https://phabricator.wikimedia.org/tag/php_8.1_support/, https://phabricator.wikimedia.org/tag/php_8.2_support/ and https://phabricator.wikimedia.org/tag/php_8.3_support/ for the relevant work boards. As a reminder, when 1.35 was released, it was originally due to become end of life (EOL) at the end of September 2023. Due to 1.39 being released late (November 2022), and to honor the commitment to the 1 year overlap of MediaWiki LTS releases, this formal EOL process is being delayed till at least the end of November 2023. In practice, this may become sometime in December 2023, to coincide with the security and maintenance release for this quarter. A formal EOL announcement will come in advance It is therefore expected that 1.35.13 in December 2023 will become the final release for the 1.35 branch. It is noted that support and CI for 1.35 is becoming more limited; backports are being done on a best effort basis. Browser testing has been dropped for 1.35 in Wikimedia CI, due to the difficulties to support this. It is strongly recommended to upgrade to 1.39 (the next LTS after 1.35), which will be supported until November 2025, or 1.40, which will be supported until June 2024. == Security fixes == * (T264765, CVE-2023-PENDING) SECURITY: Users without correct permission are incorrectly shown MediaWiki:Missing-revision-permission. * (T333050, CVE-2023-PENDING) SECURITY: Fix infinite loop for self-redirects with variants conversion. * (T340217, CVE-2023-PENDING) SECURITY: Vector 2022: Numerous unescaped messages leading to potential XSS. * (T340220, CVE-2023-PENDING) SECURITY: Vector 2022: vector-intro-page message is assumed to yield a valid title. * (T340221, CVE-2023-PENDING) SECURITY: XSS via 'youhavenewmessagesmanyusers' and 'youhavenewmessages' messages. * (T341529, CVE-2023-PENDING) SECURITY: diff-multi-sameuser ("X intermediate revisions by the same user not shown") ignores username suppression. * (T341565, CVE-2023-3550) SECURITY: Stored XSS when uploading crafted XML file to Special:Upload (non-standard configuration). == Links to all mentioned tasks == * https://phabricator.wikimedia.org/T264765 * https://phabricator.wikimedia.org/T333050 * https://phabricator.wikimedia.org/T340217 * https://phabricator.wikimedia.org/T340220 * https://phabricator.wikimedia.org/T340221 * https://phabricator.wikimedia.org/T341529 * https://phabricator.wikimedia.org/T341565 == Release notes == Full release notes for 1.35.12: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_35/RELEASE-NOT... https://www.mediawiki.org/wiki/Release_notes/1.35 Full release notes for 1.39.5: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_39/RELEASE-NOT... https://www.mediawiki.org/wiki/Release_notes/1.39 Full release notes for 1.40.1: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_40/RELEASE-NOT... https://www.mediawiki.org/wiki/Release_notes/1.40 For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.12.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.12.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.12.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.12.zip Patch to previous version (1.35.11): https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.12.patch.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.12.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.12.tar.... https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.12.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.12.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.12.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.12.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.12.patch.zip... Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.5.tar.gz https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.5.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.5.tar.gz https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.5.zip Patch to previous version (1.39.4): https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.5.patch.gz https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.5.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.5.tar.g... https://releases.wikimedia.org/mediawiki/1.39/mediawiki-core-1.39.5.zip.sig https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.5.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.5.zip.sig https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.5.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.39/mediawiki-1.39.5.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.1.tar.gz https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.1.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.40/mediawiki-core-1.40.1.tar.gz https://releases.wikimedia.org/mediawiki/1.40/mediawiki-core-1.40.1.zip Patch to previous version (1.40.0): https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.1.patch.gz https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.1.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.40/mediawiki-core-1.40.1.tar.g... https://releases.wikimedia.org/mediawiki/1.40/mediawiki-core-1.40.1.zip.sig https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.1.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.1.zip.sig https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.1.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.1.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html _______________________________________________ MediaWiki-announce mailing list -- mediawiki-announce(a)lists.wikimedia.org To unsubscribe send an email to mediawiki-announce-leave(a)lists.wikimedia.org

2 Jahre

1
0
0 / 0

GitLab Security Release 16.4.1, 16.3.5, 16.2.8

by GitLab Security Team

To view this email as a web page, go to the following address: https://page.gitlab.com/index.php/email/emailWebview?mkt_tok=MTk0LVZWQy0y... Today we are releasing versions 16.4.1, 16.3.5 and 16.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important security fixes and <strong>we strongly recommend that all GitLab installations be upgraded to one of these versions immediately</strong>. You can see details in this security release blog post <https://about.gitlab.com/releases/2023/09/28/security-release-gitlab-16-4... 28 2023>. Please forward this alert to appropriate people at your organization and have them subscribe to Security Notices <https://about.gitlab.com/company/contact/>. You can also receive security release blog updates by subscribing to our security release RSS feed <https://about.gitlab.com/security-releases.xml> or our RSS feed for all GitLab releases <https://about.gitlab.com/all-releases.xml>. GitLab releases patches for vulnerabilities in two types of dedicated security releases: a monthly security release, released a week after the feature release (which deploys on the 22nd of each month), and ad-hoc security releases for critical vulnerabilities. For more information, you can visit our security FAQ <https://email.gitlab.com/MTk0LVZWQy0yMjEAAAGOfAfghTvC7v4hFT-REVWkKu0oOQvR...>. Sincerely, GitLab Security Team GitLab 268 Bush Street, #350, San Francisco, CA 94104, USA This email was sent to topf(a)zapf.in. You may unsubscribe <[[https://page.gitlab.com/UnsubscribePage.html?mkt_unsubscribe=1&mkt_tok=MT...]]> anytime from GitLab's marketing emails but you will still receive operational emails related to your account.

2 Jahre

1
0
0 / 0

Fwd: Fwd: Username für Anmeldung vergessen

by kern-michler＠posteo.de

Hallo zusammen, ich kümmere mich. Liebe Grüße, Daniela -------- Originalnachricht -------- Betreff: [TOPF] Fwd: Username für Anmeldung vergessen Datum: 28.09.2023 13:19 Von: Orga-Team der ZaPF 2023 in Düsseldorf <zapf(a)hhu.de> An: topf(a)zapf.in Antwort an: Technisches Organisationsgremium der Physik-Fachschaften <topf(a)zapf.in> Hallo lieber TOPF, uns hat diese Anfrage erreicht. Vielleicht wisst ihr ja mehr dazu... LG Magdalena -------- Weitergeleitete Nachricht -------- BETREFF: Username für Anmeldung vergessen DATUM: Thu, 28 Sep 2023 11:25:38 +0200 VON: Hannah Kramer <hannahkramerkassel(a)gmail.com> AN: zapf(a)hhu.de <zapf(a)hhu.de> Hallo ihr Lieben, ich habe leider meinen Usernamen für die Anmeldung vergessen und konnte den Namen bisher auch nirgends irgendwo in einer Mail finden. Bzw lediglich das Passtwort zurücksetzten. Ich bitte euch um Hilfe. Kann ich den Namen irgendwo einsehen, oder muss ich mir ein neuen Account zulegen? Mit freundlichen Entengrüßen Hannah Kramer FSR Physik Halle Gesendet von Mail [1] für Windows Links: ------ [1] https://go.microsoft.com/fwlink/?LinkId=550986 _______________________________________________ TOPF mailing list -- topf(a)zapf.in To unsubscribe send an email to topf-leave(a)zapf.in

2 Jahre

1
0
0 / 0

Fwd: Username für Anmeldung vergessen

by Orga-Team der ZaPF 2023 in Düsseldorf

Hallo lieber TOPF, uns hat diese Anfrage erreicht. Vielleicht wisst ihr ja mehr dazu... LG Magdalena -------- Weitergeleitete Nachricht -------- Betreff: Username für Anmeldung vergessen Datum: Thu, 28 Sep 2023 11:25:38 +0200 Von: Hannah Kramer <hannahkramerkassel(a)gmail.com> An: zapf(a)hhu.de <zapf(a)hhu.de> Hallo ihr Lieben, ich habe leider meinen Usernamen für die Anmeldung vergessen und konnte den Namen bisher auch nirgends irgendwo in einer Mail finden. Bzw lediglich das Passtwort zurücksetzten. Ich bitte euch um Hilfe. Kann ich den Namen irgendwo einsehen, oder muss ich mir ein neuen Account zulegen? Mit freundlichen Entengrüßen Hannah Kramer FSR Physik Halle Gesendet von Mail <https://go.microsoft.com/fwlink/?LinkId=550986> für Windows

2 Jahre

1
0
0 / 0

Wartung Ihres V-Servers am 10.10.2023 - Auftrag: 4862329

by STRATO

Bitte prüfen Sie vor der Wartung, ob Ihr Server bootfest ist.???????????????????????????????????????????????????? -------------------------------------------------------------------- Zur Online-Version [1] [1] https://news.strato.de/go/7/5JNJ9JR3-4246DBQV-3CZSEP0U-1DU01R3-o.html -------------------------------------------------------------------- [1] Ihre Kundennummer: 73610332 Ihre Auftragsnummer 4862329 [2] [1] https://www.strato.de/forward/OPTIVO/?url=https%3A%2F%2Fwww.strato.de%2F%... [2] https://www.strato.de/forward/OPTIVO/?url=https%3A%2F%2Fwww.strato.de%2Fa... -------------------------------------------------------------------- Serverwartung am 10.10.2023 Hallo Arne Küderle, aufgrund von Sicherheits- und Stabilitätskorrekturen müssen wir Wartungsarbeiten an unseren Virtualisierungs-Plattformsystemen durchführen. Die Arbeiten werden in der Nacht vom 10.10.2023 auf den 11.10.2023 zwischen 23:00 Uhr und 04:00Uhr stattfinden. Die Erreichbarkeit Ihres Virtual Server Linux Level 2 (v1410.6/12) (Auftrag: 4862329) kann dadurch bis zu 3 Stunden eingeschränkt sein. Im Rahmen dieser Wartungsarbeiten werden die Systeme temporär heruntergefahren, um wichtige Aktualisierungen durchzuführen. Da die Systeme nacheinander aktualisiert werden, ist der genaue Zeitpunkt von System zu System verschieden. Wir empfehlen Ihnen Ihren Server auf eine bootfeste Konfiguration zu überprüfen [1]. So stellen Sie sicher, dass Ihr Server nach der Wartung wie gewohnt funktioniert. [1] https://www.strato.de/faq/server/reboot-vom-strato-server/?swtssa=germain... -------------------------------------------------------------------- Wir bedauern eventuelle Unannehmlichkeiten. Mit freundlichen Grüßen Ihr STRATO Team -------------------------------------------------------------------- Bitte beachten Sie, dass Sie auf diese E-Mail nicht direkt antworten können. Anschrift: STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin Die gesetzlichen Pflichtangaben gemäß § 80 AktG finden Sie unter https://www.strato.de/impressum/. [1] [2] [3] [4] [5] [6] [1] https://www.strato.de/impressum/?swtssa=germainne0000000000000000 [2] https://twitter.com/STRATO_hilft?swtssa=germainne0000000000000000 [3] https://www.youtube.com/user/stratoDE?swtssa=germainne0000000000000000 [4] https://www.facebook.com/stratohilft?swtssa=germainne0000000000000000 [5] https://de.linkedin.com/company/strato-ag?swtssa=germainne0000000000000000 [6] https://www.xing.com/pages/strato?swtssa=germainne0000000000000000 -------------------------------------------------------------------- [1] Copyright © 2023 STRATO AG Karriere [2] Impressum [3] Kontakt [4] [1] https://www.strato.de/forward/OPTIVO/?url=https%3A%2F%2Fwww.strato.de%2F%... [2] https://www.strato.de/karriere/?swtssa=germainne0000000000000000 [3] https://www.strato.de/forward/OPTIVO/?url=https%3A%2F%2Fwww.strato.de%2Fi... [4] https://www.strato.de/forward/OPTIVO/?url=https%3A%2F%2Fwww.strato.de%2Ff...

2 Jahre

1
0
0 / 0

[MediaWiki-announce] Security pre-release announcement: 1.35.12 / 1.39.5 / 1.40.1

by Sam Reed

Hi all, On Thursday we will be issuing a security and maintenance release to all supported branches of MediaWiki. The new releases will be: - 1.35.12 - 1.39.5 - 1.40.1 This will resolve four security issues in MediaWiki core, two in a bundled skin, along with bug fixes included for maintenance reasons. This includes various patches for PHP 8.0, PHP 8.1 and PHP 8.2 support. One issue in a bundled skin only affects MediaWiki 1.40 and master, the other bundled skin issue affects MediaWiki 1.39, 1.40 and master. A partial fix for one of the skin issues is already merged into the relevant release branch. One more minor security fix was merged in public after the releases of 1.35.11/1.38.7/1.39.4/1.40.0. We will make the fixes available in the respective release branches and master in git. Tarballs will be available for the above mentioned point releases as well. A summary of some of the security fixes that have gone into non-bundled MediaWiki extensions will also follow later. As a reminder, when 1.35 was released, it was originally due to become end of life (EOL) at the end of September 2023. Due to 1.39 being released late (November 2022), and to honor the commitment to the 1 year overlap of MediaWiki LTS releases, this formal EOL process is being delayed till at least the end of November 2023. In practice, this may become sometime in December 2023, to coincide with the security and maintenance release for that quarter. A formal EOL announcement for 1.35 will come in advance of that point. It is therefore expected that 1.35.13 in December 2023 will become the final release for the 1.35 branch. It is noted that support and CI for 1.35 is becoming more limited; backports are becoming best-effort. Browser testing has been dropped for 1.35 in Wikimedia CI, due to the difficulties to support this. It is strongly recommended to upgrade to 1.39 (the next LTS after 1.35), which will be supported until November 2025, or 1.40, which will be supported until June 2024. [1] https://www.mediawiki.org/wiki/Version_lifecycle _______________________________________________ MediaWiki-announce mailing list -- mediawiki-announce(a)lists.wikimedia.org To unsubscribe send an email to mediawiki-announce-leave(a)lists.wikimedia.org

2 Jahre

1
0
0 / 0

studienreformforum@zapf.in post from noreply@createimage.in requires approval

by studienreformforum-owner＠zapf.in

As list administrator, your authorization is requested for the following mailing list posting: List: studienreformforum(a)zapf.in From: noreply(a)createimage.in Subject: Dr. Neeta Singh The message is being held because: The message is not from a list member At your convenience, visit your dashboard to approve or deny the request.

2 Jahre

1
0
0 / 0

Kurzbericht ZaPF 2023 Berlin

by Steph Wagner

Lieber TOPF, im Anhang der Kurzbericht der Sommer-Zapf in Berlin mit der Bitte, ihn möglichst schnell unter https://zapfev.de/zapf/veroffentlichungen/ bereitzustellen. Vielen vielen Dank Steph für die Berlin-Orga

2 Jahre

2
1
0 / 0

studienreformforum@zapf.in post from notify@vtehnologies.com requires approval

by studienreformforum-owner＠zapf.in

As list administrator, your authorization is requested for the following mailing list posting: List: studienreformforum(a)zapf.in From: notify(a)vtehnologies.com Subject: Kumar Biswas The message is being held because: The message is not from a list member At your convenience, visit your dashboard to approve or deny the request.

2 Jahre

1
0
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

TOPF September 2023