Test ID:	1.3.6.1.4.1.25623.1.1.10.2023.0241
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2023-0241)
Summary:	The remote host is missing an update for the 'mediawiki' package(s) announced via the MGASA-2023-0241 advisory.
Description:	Summary: The remote host is missing an update for the 'mediawiki' package(s) announced via the MGASA-2023-0241 advisory. Vulnerability Insight: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n (CVE-2023-29197). Manualthumb bypasses badFile lookup (CVE-2023-36674). XSS in BlockLogFormatter due to unsafe message use (CVE-2023-36675). Affected Software/OS: 'mediawiki' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-29197 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775 https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96 https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4 https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html Common Vulnerability Exposure (CVE) ID: CVE-2023-36674 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CHRX6DSLAMVXCV2YMJEWOLTBEYSESE5/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UIVGYECQGTUC2LLPVCZBPDLCTOHL2F6/ https://phabricator.wikimedia.org/T335612 Common Vulnerability Exposure (CVE) ID: CVE-2023-36675 Debian Security Information: DSA-5447 (Google Search) https://www.debian.org/security/2023/dsa-5447 https://phabricator.wikimedia.org/T332889 https://www.mediawiki.org/wiki/Release_notes/1.40#Other_changes_in_1.40
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.