CVE-2020-25828

Name	CVE-2020-25828
Description	An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.)
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2379-1, DSA-4767-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mediawiki (PTS)	stretch (security)	1:1.27.7-1+deb9u11	fixed
	stretch (lts), stretch	1:1.27.7-1+deb9u13	fixed
	buster (security), buster, buster (lts)	1:1.31.16-1+deb10u8	fixed
	bullseye	1:1.35.13-1+deb11u2	fixed
	bullseye (security)	1:1.35.13-1+deb11u3	fixed
	bookworm (security), bookworm	1:1.39.10-1~deb12u1	fixed
	sid, trixie	1:1.39.10-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
mediawiki	source	stretch	1:1.27.7-1~deb9u4	DLA-2379-1
mediawiki	source	buster	1:1.31.10-1~deb10u1	DSA-4767-1
mediawiki	source	(unstable)	1:1.35.0-1

https://lists.wikimedia.org/pipermail/wikitech-l/2020-September/093888.html
https://phabricator.wikimedia.org/T115888