Description
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mediawiki | mediawiki | before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mediawiki | 1:1.31.1-1 | — |
| Debian 13 | mediawiki | 1:1.31.1-1 | — |
| Debian 12 | mediawiki | 1:1.31.1-1 | — |
| Debian 9 | mediawiki | 1:1.27.5-1~deb9u1 | DSA-4301-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | mediawiki | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | mediawiki +1 | 1.27.7-1.el7 | RHSA-2019:3238, RHSA-2019:3142 |
| Red Hat OpenShift 3 | mediawiki123 +1 | 1.23.17-1.el7 | RHSA-2019:3813 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | mediawiki/core | >= 1.27.0, < 1.27.5 | 1.27.5 | GHSA-5c6w-f4w2-2grp |
| Packagist | mediawiki/core | >= 1.29.0, < 1.29.3 | 1.29.3 | GHSA-5c6w-f4w2-2grp |
| Packagist | mediawiki/core | >= 1.30.0, < 1.30.1 | 1.30.1 | GHSA-5c6w-f4w2-2grp |
| Packagist | mediawiki/core | >= 1.31.0, < 1.31.1 | 1.31.1 | GHSA-5c6w-f4w2-2grp |
Advisories 4
- DSA-4301-1 mediawiki - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2019:3813 Red Hat Security Advisory: OpenShift Container Platform 3.9 mediawiki123 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2019:3238 Red Hat Security Advisory: OpenShift Container Platform 3.10 mediawiki security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2019:3142 Red Hat Security Advisory: OpenShift Container Platform 3.11 mediawiki security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- [wikitech-l] 20180920 Security release: 1.27.5 / 1.29.3 / 1.30.1 / 1.31.1 mailing-list
- https://phabricator.wikimedia.org/T194605
- 1041695 vdb-entry
- DSA-4301 vendor-advisory
- RHSA-2019:3142 vendor-advisory
- RHSA-2019:3238 vendor-advisory
- RHSA-2019:3813 vendor-advisory