urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cve id

master
Joey Hess 2008-05-31 20:16:18 -04:00
parent 99e5e6dd08
commit c1289de1ef
3 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
debian/changelog vendored
View File

@ -11,7 +11,7 @@ ikiwiki (2.48) unstable; urgency=high
* Fix security hole that occurred if openid and passwordauth were both
enabled. passwordauth would allow logging in as a known openid, with an
empty password. Closes: #483770
empty password. Closes: #483770 (CVE-2008-0169)
* Add rel=nofollow to edit links. This may prevent some spiders from
pounding on the cgi following edit links.
* passwordauth: If Authen::Passphrase is installed, use it to store

1
doc/news/version_2.48.mdwn
View File

@ -13,6 +13,7 @@ ikiwiki 2.48 released with [[toggle text="these changes"]]
* Fix security hole that occurred if openid and passwordauth were both
enabled. passwordauth would allow logging in as a known openid, with an
empty password. Closes: #[483770](http://bugs.debian.org/483770)
(CVE-2008-0169)
* Add rel=nofollow to edit links. This may prevent some spiders from
pounding on the cgi following edit links.
* passwordauth: If Authen::Passphrase is installed, use it to store

2
doc/security.mdwn
View File

@ -403,7 +403,7 @@ passwords in cleartext over the net to log in, either.
This hole allowed ikiwiki to accept logins using empty passwords, to openid
accounts that didn't use a password. It was introduced in version 1.34, and
fixed in version 2.48. The [bug](http://bugs.debian.org/483770) was
discovered on 30 May 2008 and fixed the same day.
discovered on 30 May 2008 and fixed the same day. ([[cve CVE-2008-0169]])
I recommend upgrading to 2.48 immediatly if your wiki allows both password
and openid logins.